1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 PATRICK YOCKEY, et al., Case No. 22-cv-09067-JST

8 Plaintiffs,

ORDER DENYING DEFENDANT’S

9 v. MOTION TO DISMISS

10 SALESFORCE, INC., Re: ECF No. 44 Defendant. 11

12 13 Before the Court is Defendant Salesforce, Inc.’s motion to dismiss Plaintiffs’ second 14 amended complaint. ECF No. 44. The Court will deny the motion. 15 I. BACKGROUND 16 Salesforce offers a service called Chat that operates from Salesforce’s web servers but is 17 functionally implemented on Rite Aid’s and Kaiser Permanente’s websites, allowing Rite Aid’s 18 and Kaiser Permanente’s customers to interact with the company directly on the website. ECF 19 No. 43 ¶¶ 11–13. Chat “is a combination of a basic customer service chat function and backend 20 analytics tools to ostensibly improve a company’s customer service experience.” Id. ¶ 11.1 21 Chat works as follows. When a customer sends a chat message to a company’s customer 22 service agent, “it is first routed through a Salesforce server.” Id. ¶ 13. Transcripts of 23 communications over Chat are automatically created in real time and subsequently transmitted to 24 the contracting company. Id. ¶ 15. Chat also includes a “Sneak Peek” feature, which enables an 25

26 1 Specifically, Chat is an application programming interface (“API”), id. ¶ 12, which is a tool that allows programmers to use “pre-written code to build certain functions into their own programs, 27 rather than write their own code to perform those functions from scratch.” Google LLC v. Oracle 1 agent to view the contents of a customer’s message while the customer types the message, i.e., 2 before the customer sends the message to the agent. Id. ¶ 22–23. Plaintiffs, users of Rite Aid’s 3 and Kaiser Permanente’s websites, now bring this putative class action against Salesforce for 4 violations of the California Invasion of Privacy Act (“CIPA”) Sections 631 and 632 and violation 5 of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”). Id. ¶¶ 38– 6 83 (citing Cal. Penal Code §§ 631–632; 18 Pa. Cons. Stat. §§ 5701, et seq.). 7 Salesforce previously moved to dismiss Plaintiffs’ complaint for failure to state a claim 8 under either statute. ECF No. 23. The Court largely denied the motion, finding that Plaintiffs had 9 standing to bring their statutory claims; rejecting Salesforce’s argument regarding Section 632 that 10 the communications were not confidential and that Plaintiffs had consented to the recording of 11 their communications; and rejecting Salesforce’s arguments concerning WESCA that Salesforce 12 had not intercepted Plaintiff Yockey’s communications, that it had not used a “device” to intercept 13 them, that WESCA imposed a requirement that Yockey’s communications be rerouted 14 contemporaneously with transmission, that the alleged interception was a “necessary incident to 15 the rendition of [Salesforce’s] service, and that (again) Yockey had consented to Salesforce’s 16 conduct.” ECF No. 35. The Court did grant the motion in part, however, finding that Plaintiffs’ 17 “allegations [did] not support a reasonable inference that Salesforce has the capability to use these 18 communications for any purpose other than furnishing them to Kaiser” in order to state a claim 19 pursuant to Section 631. Id. at 9. The Court granted leave to Plaintiffs to amend their complaint 20 only with respect to their CIPA Section 631 claim. Id. at 16. 21 Plaintiffs then filed a second amended complaint (“SAC”). ECF No. 43. The SAC 22 contains new allegations regarding how Salesforce can use the intercepted communications for its 23 own purposes. Id. ¶ 26. Specifically, Plaintiffs allege that the “Chat communications are sent to 24 Salesforce’s Einstein data intelligence platform” which are then used to “train the AI models that 25 form the basis of some of its services.” Id. Plaintiffs add that “Salesforce has the capability to use 26 Chat communications to (i) improve Salesforce’s own products and services; (ii) develop new 27 Salesforce products and services; and (iii) analyze Chat communications to assist with customer 1 Salesforce now moves to dismiss the SAC. ECF No. 44. Plaintiffs have filed an 2 opposition, ECF No. 45, and Salesforce has filed a reply, ECF No. 46. 3 II. JURISDICTION 4 The Court has jurisdiction pursuant to 28 U.S.C. § 1332(d)(2)(A). 5 III. LEGAL STANDARD 6 To survive a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a 7 complaint must contain “a short and plain statement of the claim showing that the pleader is 8 entitled to relief.” Fed. R. Civ. P. 8(a)(2). Dismissal “is appropriate only where the complaint 9 lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” 10 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). “[A] complaint 11 must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible 12 on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 13 550 U.S. 544, 570 (2007)). Factual allegations need not be detailed, but facts must be “enough to 14 raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. 15 “A claim has facial plausibility when the plaintiff pleads factual content that allows the 16 court to draw the reasonable inference that the defendant is liable for the misconduct 17 alleged.” Iqbal, 556 U.S. at 678. While this standard is not “akin to a ‘probability 18 requirement,’ . . . it asks for more than a sheer possibility that a defendant has acted unlawfully.” 19 Id. (quoting Twombly, 550 U.S. at 556). “Where a complaint pleads facts that are ‘merely 20 consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and 21 plausibility of entitlement to relief.’” Id. (quoting Twombly, 550 U.S. at 557). In determining 22 whether a plaintiff has met the plausibility requirement, a court must “accept all factual allegations 23 in the complaint as true and construe the pleadings in the light most favorable” to the 24 plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A plaintiff may “plead[] facts 25 alleged upon information and belief where the facts are peculiarly within the possession and 26 control of the defendant or where the belief is based on factual information that makes the 27 inference of culpability plausible.” Soo Park v. Thompson, 851 F.3d 910, 928 (9th Cir. 2017) 1 IV. DISCUSSION 2 Salesforce argues that (1) Plaintiffs fail to state a claim under the CIPA; (2) the WESCA’s 3 distinct mutual consent exception applies to the Pennsylvania Plaintiffs and Salesforce’s collection 4 of their information; and (3) Plaintiffs cannot apply the CIPA extraterritorially to Pennsylvania 5 residents. ECF No. 44. Plaintiffs maintain that they have sufficiently alleged violations of the 6 CIPA and the WESCA. ECF No. 45 at 11–23. 7 A. Motion to Dismiss CIPA § 632 and WESCA Claims 8 As a threshold issue, Plaintiffs contend that Salesforce’s new and previously rejected 9 arguments regarding the CIPA and the WESCA should be treated as a “de facto motion for 10 reconsideration” and denied on that basis. Id. at 8–11. 11 In addition to other challenges, Salesforce’s motion to dismiss once again argues that 12 Plaintiffs have failed to state a claim under CIPA Section 632 and WESCA. ECF No. 44 at 15– 13 23. Plaintiffs object to these arguments because the Court already found that the Plaintiffs stated a 14 claim under CIPA Section 632 and WESCA. ECF No. 45 at 7; ECF No. 35. Plaintiffs contend 15 that “it is improper to file a motion to dismiss an amended complaint where the amended 16 complaint asserts no new causes of action.” ECF No. 45 at 8. Salesforce responds that “an 17 amended complaint supersedes the prior one, rendering it ‘without legal effect.’” ECF No. 46 at 9 18 (citing Lacey v. Maricopa Cnty., 693 F.3d 896, 927 (9th Cir. 2012)). 19 The Court largely agrees with Salesforce. “It is well-established in our circuit that an 20 amended complaint supersedes the original, the latter being treated thereafter as non-existent.” 21 Ramirez v. County of San Bernardino, 806 F.3d 1002, 1008 (9th Cir. 2015) (internal citation and 22 quotation marks omitted). A motion to dismiss an amended complaint “is not a motion for 23 reconsideration of the Court’s prior order, but, rather, a new motion addressing a newly filed 24 complaint.” Turner v. Tierney, No. 12-cv-6231-MMC, 2013 WL 2156264, at *1 (N.D. Cal. May 25 17, 2013). “In the interest of judicial economy,” courts in this circuit will consider arguments 26 under a Rule 12(b)(6) motion that otherwise could be brought in a later Rule 12(c) motion. W. 27 Digit. Techs., Inc. v. Viasat, Inc., No. 22-cv-04376-HSG, 2023 WL 7739816, at *2 (N.D. Cal. 1 The cases cited by Plaintiffs do not compel a different result because these cases involve 2 defendants who filed a motion to dismiss on an amended complaint after answering the original 3 complaint. See Pascal v. Concentra, Inc., No. 19-cv-02559-JCS, 2020 WL 4923974, at *2 (N.D. 4 Cal. Aug. 21, 2020) (rejecting defendant’s 12(b)(6) challenges because defendant answered the 5 complaint); Brooks v. Caswell, No. 14-cv-01232-AC, 2016 WL 866303, at *3 (D. Or. Mar. 2, 6 2016) (same); Townsend Farms v. Goknur Gida Madderleri Enerji Imalat Ithalat Ihracat Ticaret 7 Ve Sanayi A.S., No. 15-cv-0837-DOC-JCGx, 2016 WL 10570248, at *1 (C.D. Cal. Aug. 17, 2016) 8 (same); Best Fresh LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL 9 4112231, at *10 (S.D. Cal. Sept. 8, 2022)2 (same). Here, no answer has been filed, Plaintiffs have 10 filed an amended complaint, and Salesforce raises new arguments it didn’t previously raise. 11 Salesforce may assert these new defenses not previously presented to the Court.3 12 B. CIPA 13 1. Section 631 14 CIPA Section 631 creates liability in four circumstances: 15 (1) where a person “by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes 16 any unauthorized connection . . . with any telegraph or telephone wire, line, cable, or instrument”; 17 (2) where a person “willfully and without consent of all parties to 18 the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any 19 message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or 20 received at any place within this state”;

21 (3) where a person “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so 22 obtained”; and

23 (4) where a person “aids, agrees with, employs, or conspires with 24 2 Furthermore, certain district courts have entertained post-answer motions to dismiss amended 25 complaints for the purpose of judicial economy or based on distinguishing factors. Best Fresh LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL 4112231, at *6 (S.D. 26 Cal. Sept. 8, 2022).

27 3 What the Court says here should not be construed as license simply to reassert arguments the any person or persons to unlawfully do, or permit, or cause to be 1 done any of the acts or things mentioned above.” 2 Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 897 (N.D. Cal. 2023) (quoting Cal. Penal Code 3 § 631(a)). In addition, a plaintiff must show that the third party “ha[s] the capability to use its 4 record of the interaction for any other purpose.” Id. at 900. 5 Salesforce’s motion to dismiss challenges whether Plaintiffs have shown that (1) 6 Salesforce has the “capability to use its record of the interaction for any other purpose”; and (2) 7 Salesforce reads the messages “in transit” under Section 631(a)(2). 8 a. Capability To Use Communications for Other Purposes 9 The Court previously dismissed Plaintiffs’ Section 631 claim because Plaintiffs’ 10 “allegations [did not] support a reasonable inference that Salesforce ha[d] the capability to use 11 these communications for any purpose other than furnishing them to [customer websites].” ECF 12 No. 35 at 9. 13 Plaintiffs have now amended their complaint to allege that Salesforce sends the chat 14 communications to “Salesforce’s Einstein data intelligence platform” to “train the AI models that 15 form the basis of some of its services.” ECF No. 43 ¶ 26. Plaintiffs add that “Salesforce has the 16 capability to use Chat communications to (i) improve Salesforce’s own products and services; (ii) 17 develop new Salesforce products and services; and (iii) analyze Chat communications to assist 18 with customer service interactions and data analytics.” Id. ¶ 28. Salesforce disagrees with 19 Plaintiffs’ characterization of these tools as a factual matter, but concedes that Plaintiffs have now 20 sufficiently alleged that Salesforce “has the capability to use [Chat] communications for [] 21 purpose[s] other than furnishing them to Kaiser.” ECF No. 44 at 15. 22 Because Plaintiffs have properly alleged that Salesforce has the ability to use its record of 23 the interaction for other purposes beyond just furnishing them to customer websites, the Court 24 finds that Plaintiffs have alleged sufficient facts to meet the plausibility requirement. Knievel, 393 25 F.3d at 1072 (9th Cir. 2005). 26 b. Interception of Communications “In Transit” 27 Every clause of Section 631(a) has three requirements in common: “(1) the absence of 1 Keurig Green Mountain, Inc., 674 F. Supp. 3d 751, 756 (N.D. Cal. 2023) (citing Cal. Penal Code 2 § 631(a)). Salesforce asserts that Plaintiffs fail to state a claim because the communications “are 3 not read ‘in transit’ and are by definition outside the scope of [S]ection 631(a).” ECF No. 44 at 4 14. That is, Salesforce argues that the “data transmitted (containing the typed Chat text) can be 5 read only after arriving at Salesforce’s servers—not while they are in transmission.” Id. 6 (emphasis in original). Plaintiffs respond that Salesforce’s servers provide “transient electronic 7 storage that is intrinsic to the communication,” but such transient storage still means that 8 communications are intercepted “in transit.” ECF No. 45 at 13–15. Salesforce replies that 9 electronic signals sent over the internet must arrive on Salesforce’s server before computer 10 systems can interpret and display the typed text and therefore cannot be intercepted “in transit.” 11 ECF No. 46 at 12–13. At its core, Salesforce’s argument is that it has not “intercepted” 12 communications because it was both the intended destination server of the communications and 13 the transient server “before computer systems [could] interpret and display the typed text.”4 Id. 14 The cases cited by Salesforce, however, do not support its argument. In the first set of 15 cases, the messages were clearly in digital storage and therefore were not simultaneously or 16 contemporaneously intercepted. See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th 17 Cir. 2002) (finding no interception where messages were retrieved from bulletins and postings on 18 a secure website); see also Theofel v. Farey-Jones, 359 F.3d 1066, 1077 (9th Cir. 2004) 19 (addressing copies of e-mails transmitted in the past retained by the internet service provider). In 20 the second set of cases, the communications were considered not “in transit” because the 21 defendant gained access after receipt by the intended recipient. See Adler v. Community.com, Inc., 22 No. 2:21-cv-02416-SBJPR, 2021 WL 4805435, at *4 (C.D. Cal. Aug. 2, 2021) (finding that CIPA 23 Section 631 claim failed because plaintiff alleged defendant gained access to plaintiff’s text “upon 24

25 4 Although Plaintiffs respond that chat messages are in transient storage, ECF No. 45 at 14–15, this argument is not responsive to Salesforce’s contention. Salesforce’s argument is that 26 regardless of whether the chat messages are transient (i.e., incidental to the sending of the message) or permanent, the Salesforce server is the only server that is used in the transmission of 27 these chats, and therefore Salesforce could not intercept such communications. However, as the 1 the completion of its transmission to the proper number”); Swarts v. Home Depot, Inc., 689 F. 2 Supp. 3d 732, 746 (N.D. Cal. 2023) (finding that plaintiffs allegations that “online traffic occurs 3 between the customer’s browser and several liveperson.net subdomains” “does not indicate when 4 the interception occurs . . . [and] does not dispel the notion that LivePerson receives the 5 information after the chat reaches Home Depot.”); see also Martin v. Sephora USA, Inc., No. 22- 6 cv-01355-JLT-SAB, 2023 WL 2717636, at *10 (E.D. Cal. Mar. 30, 2023), report and 7 recommendation adopted, No. 22-cv-01355-JLT-SAB, 2023 WL 3061957 (E.D. Cal. Apr. 24, 8 2023) (dismissing plaintiffs’ Section 631(a) claim because the allegations in the complaint stated 9 that defendant (Sephora) “records and creates transcripts of the chats, which Hubspot/Salesforce is 10 then permitted to access,” and plaintiffs failed to make any non-conclusory allegations about how 11 the transcripts are intercepted simultaneously by Hubspot/Salesforce.) 12 Those are not the allegations here. First, Salesforce does not argue that chat messages to 13 and from Rite-Aid and Kaiser websites reside in long-term storage on Salesforce’s servers. 14 Second, notwithstanding Salesforce’s arguments to the contrary, Salesforce is not the intended 15 recipient. Salesforce conflates Section 631(a)’s requirement of receipt by the intended recipient 16 with receipt by the destination server. These are not the same thing. “[T]he crucial question under 17 § 631(a)’s second clause is whether [a plaintiff] has plausibly alleged that [the defendant] read one 18 of his communications while it was still in transit, i.e., before it reached its intended recipient.” 19 Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1137 (E.D. Cal. 2021) (emphasis added). 20 Salesforce’s argument is identical to one recently rejected in Lopez v. Apple, Inc., 519 F. 21 Supp. 3d 672, 683 (N.D. Cal. 2021). In Lopez, plaintiffs brought a putative consumer class action 22 against Apple for violating the CIPA when Siri intercepted and disclosed “private discussions 23 between doctors and patients, confidential business deals, and sexual encounters.” Id. at 679. 24 Plaintiffs alleged “that they did not intend Apple to receive their private communications, but that 25 Apple ‘captured’ such communications using the software in their devices.” Id. at 683. Like 26 Salesforce, Apple argued “that it ha[d] not ‘intercepted’ communications because it was the 27 intended recipient of the communications.” Id. The Court disagreed and held that plaintiffs 1 Here too, Plaintiffs have alleged that the intended recipient of communications concerning 2 medical conditions, insurance information, and prescription history, ECF No. 43 ¶¶ 31–34, are 3 Plaintiffs’ doctors and pharmacists, respectively—not Salesforce. Lopez, 519 F. Supp. 3d at 683. 4 While the information was routed through Salesforce’s server, the “intended recipients” were Rite 5 Aid and Kaiser. Id. The reasonable inference here, because Salesforce “apparently receives the 6 chat messages either before or simultaneously with” its clients––the intended recipients, is that 7 Salesforce intercepts these messages. D’Angelo v. Penny OpCo, LLC, No. 23-cv-0981-BAS- 8 DDL, 2023 WL 7006793, at *8 (S.D. Cal. Oct. 24, 2023).5 9 Salesforce’s motion to dismiss Plaintiffs’ Section 631 claim is therefore denied. 10 2. Section 632 11 CIPA Section 632 imposes liability against a “person who, intentionally and without the 12 consent of all parties to a confidential communication, uses an electronic amplifying or recording 13 device to eavesdrop upon or record the confidential communication, whether the communication 14 is carried on among the parties in the presence of one another or by means of a telegraph, 15 telephone, or other device, except a radio.” Cal. Pen. Code § 632(a). 16 Salesforce argues that Plaintiffs fail to allege a Section 632 claim for two reasons: (1) 17 Plaintiffs cannot show that their communications are confidential; and (2) Plaintiffs cannot show 18 that the software in this case is a “device” under the statutory language. ECF No. 44 at 16–18. 19 a. Confidentiality of Communication 20 Salesforce argues that its “previous argument against CIPA § 632 focused on the 21 likelihood chats would be ‘shared’ or ‘disclosed,’” whereas now, it argues that Plaintiffs’ Section 22 632 claim must fail because the communications are not “confidential” under the plain text of the 23 statute because they can be recorded by others. ECF No. 46 at 15 (citing Cal. Pen. Code 24 § 632(c)). There is little daylight between these arguments, and the new argument fares no better 25 than the old. 26 5 In light of this conclusion, the Court need not reach Plaintiffs’ alternative argument that 27 Salesforce could satisfy the “in transit” requirement of Section 631(a) by “caus[ing] Plaintiff 1 The CIPA defines a “confidential communication” as “any communication carried on in 2 circumstances as may reasonably indicate that any party to the communication desires it to be 3 confined to the parties thereto, but excludes a communication made . . . in any other circumstance 4 in which the parties to the communication may reasonably expect that the communication may be 5 overheard or recorded.” Cal. Pen. Code § 632(c). 6 The Court determines the meaning of “confidential communication” using traditional tools 7 of statutory interpretation. “The first and most important canon of statutory construction is the 8 presumption ‘that a legislature says in a statute what it means and means in a statute what it says 9 there.’” In re Pangang Grp. Co., Ltd., 901 F.3d 1046, 1056 (9th Cir. 2018) (quoting Conn. Nat’l 10 Bank v. Germain, 503 U.S. 249, 253–254 (1992)). The Court “starts with the plain 11 statutory text and, ‘when deciding whether the language is plain, . . . must read the words in their 12 context and with a view to their place in the overall statutory scheme.’” Altera Corp. & 13 Subsidiaries v. Comm’r of Internal Revenue, 926 F.3d 1061, 1075 (9th Cir. 2019) (quoting King v. 14 Burwell, 576 U.S. 473, 486 (2015)). 15 The California Supreme Court has interpreted the language of Section 632 as follows: 16 the first clause includes within the statutory protection any conversation under circumstances showing that a party desires it not 17 to be overheard or recorded. The second clause then excludes a conversation under circumstances where the party reasonably 18 believes it will be overheard or recorded. Under this construction, the two clauses of section 632 do not conflict nor leave any 19 uncertainty; they act together in harmony to prohibit unconsented-to eavesdropping or recording of conversations regardless of whether 20 the party expects that the content of the conversation may later be conveyed to a third party. 21 Flanagan v. Flanagan, 27 Cal. 4th 766, 774–775 (2002) (citing Cal. Pen. Code § 632(c)). 22 Following this holding, the question then becomes, what were the parties’ reasonable expectations 23 about confidentiality? See Brown v. Google LLC, 685 F. Supp. 3d 909, 937 (N.D. Cal. 2023) (“the 24 inquiry is whether ‘any party to the communication desires it to be confined to the parties thereto.’ 25 [This] is a fact-intensive inquiry.”) (internal citation omitted). 26 In California, courts have developed a presumption that Internet communications do not 27 reasonably give rise to an expectation of confidentiality, and plaintiffs must “show[] that there is 1 something unique about these particular internet communications which justify departing from the 2 presumption.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal. 2022). In 3 its prior order, however, the Court determined that Plaintiffs did “show something unique”, which 4 was the context of the communications:

5 Plaintiffs respond that Magpayo maintained a reasonable expectation of confidentiality because she communicated 6 information related to her prescription history, medical conditions, and insurance information to the customer service agents in a 7 healthcare context. ECF No. 28 at 23. The Court agrees with Plaintiffs that the context of these communications renders them 8 confidential. 9 ECF No. 35 at 10. 10 Nothing has changed since the Court’s prior order. Once again, “Salesforce cites no 11 authority for the proposition that communications with a health care provider must occur with 12 only certain of its agents or employees to be confidential, or that such communications are not 13 confidential if conducted with a customer support worker.” Id. at 11. Accordingly, “[t]he Court 14 [again] rejects Salesforce’s argument and concludes that Magpayo’s communications were 15 ‘confidential’ within the meaning of Section 632.” Id. 16 b. Chat API Software is a “Device” 17 Salesforce next argues that Plaintiffs’ Section 632 claim fails because Plaintiffs do not 18 sufficiently allege that Salesforce used a “device” to intercept Plaintiffs’ communications. ECF 19 No. 44 at 17–18. 20 “CIPA does not define ‘device,’ and few courts have squarely addressed the issue.” 21 Gladstone v. Amazon Web Servs., Inc., No. 2:23-CV-00491-TL, 2024 WL 3276490, at *7 (W.D. 22 Wash. July 2, 2024). The Court agrees with those Ninth Circuit district court decisions that have 23 found that software qualifies as a device under Section 632. Id. at *8 (“‘device,’ as used in 24 Section 632, can include software”); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1080 25 (N.D. Cal. 2023) (holding that “Pixel software is a device under Section 632(a)”).6 26 6 The Court is aware of Doe v. Microsoft Corp., No. C23-0718-JCC, 2023 WL 8780879 (W.D. 27 Wash. Dec. 19, 2023), which held that “[b]ecause software does not constitute a ‘device’ under the 1 The Court finds these cases persuasive for at least two reasons. First, where the 2 Legislature has failed to define a term specifically, and the parties offer no legislative history that 3 would shed light on the question, “our best approach is to construe the statutory language in 4 accordance with its purpose.” Burroughs v. Operating Engineers Loc. Union No. 3, 686 F.2d 723, 5 727 (9th Cir. 1982). “In enacting [CIPA], the Legislature declared in broad terms its intent ‘to 6 protect the right of privacy of the people of this state’ from what it perceived as ‘a serious threat to 7 the free exercise of personal liberties [that] cannot be tolerated in a free and civilized society.’” 8 Ribas v. Clark, 38 Cal. 3d 355, 359 (1985) (citing Cal. Pen. Code § 630). In so doing, the 9 Legislature recognized “that advances in science and technology have led to the development of 10 new devices and techniques for the purpose of eavesdropping upon private communications and 11 that the invasion of privacy resulting from the continual and increasing use of such devices and 12 techniques has created a serious threat to the free exercise of personal liberties and cannot be 13 tolerated in a free and civilized society.” Cal. Pen. Code § 630. Thus, the Legislature itself 14 evinced a desire that the CIPA’s statutory protections should extend across the developing field of 15 technology. Furthermore, “the California Supreme Court has also emphasized that all CIPA 16 provisions are to be interpreted in light of the broad privacy-protecting statutory purposes of 17 CIPA.” Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31, 18 2022)7 (first citing Ribas, 38 Cal. 3d at 359–62; then Smith v. LoanMe, Inc., 11 Cal. 5th 183, 199– 19 200 (2021)). 20 Second, the Court looks to cases construing the word “device” in the federal Wiretap Act, 21 18 U.S.C. § 2510 et seq., because “[t]he analysis for a violation of CIPA is the same as that under 22 the federal Wiretap Act.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020) 23 (citation and quotation omitted). “The majority of courts to consider this issue have entertained 24 the notion that software may be considered a device for the purposes of the Wiretap Act.” United 25

26 2019) and Moreno v. San Francisco Bay Area Rapid Transit Dist., 2017 WL 6387764 (N.D. Cal. 2017). Those cases both involved Penal Code Section 637.7 and are distinguishable on that basis. 27 Doe v. Meta Platforms, 690 F. Supp. 3d at 1080. 1 States v. Hutchins, 361 F. Supp. 3d 779, 795 (E.D. Wis. 2019) (citing cases). That includes courts 2 within this district. See In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1087 (N.D. Cal. 2015) 3 (“Carrier IQ Software is an ‘[e]lectronic, mechanical, or other device’ which ‘can be used to 4 intercept a wire, oral, or electronic communication” pursuant to the federal Wiretap Act). 5 The Court therefore denies Salesforce’s motion to dismiss Plaintiffs’ CIPA Section 632 6 claims and finds that Plaintiffs have plausibly alleged that Chat API software is a “device.” 7 C. WESCA 8 In its first motion to dismiss, Salesforce raised four WESCA arguments: (1) that Plaintiff 9 Yockey failed to allege that Salesforce intercepted his chat; (2) that the WESCA exempts Chat 10 from its definition of “electronic, mechanical or other device”; (3) that Yockey’s allegations do 11 not establish that his communications were rerouted contemporaneously with transmission; and 12 (4) that two of WESCA’s exceptions to liability apply to Salesforce’s conduct. ECF No. 23. The 13 Court rejected all four arguments. ECF No. 35 at 12–15. 14 Salesforce now brings a different argument challenging Yockey’s WESCA claim. 15 Salesforce argues that Yockey “impliedly consented to the recording of his chat conversation” 16 because he knew or should have known the conversation was being recorded, defeating his 17 wiretap claim under WESCA. ECF No. 44 at 23. That is, Salesforce argues that it is the “chat 18 box user’s expectation of recording that matters––not who allegedly does the recording.” ECF 19 No. 46 at 21. Plaintiffs respond that “Defendant has cited no case that stands for the proposition 20 that users who send written communications impliedly consent to interceptions and use of their 21 communications by third parties other than the intended recipient.” ECF No. 45 at 21. 22 The WESCA permits interception “where all parties to the communication have given 23 prior consent to such interception.” 18 Pa. Cons. Stat. § 5704(4). “Prior consent, including 24 implied consent, can be demonstrated when the person being recorded knew or should have 25 known [ ] that the conversation was being recorded.” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 26 121, 132 (3d Cir. 2022) (internal citation and quotation marks omitted). In the case of websites, 27 this turns on whether the website’s communications with the user—for example, by displaying its 1 recorded communications. Oliver v. Noom, Inc., No. 2:22-CV-1857, 2023 WL 8600576, at *9 2 (W.D. Pa. Aug. 22, 2023) (finding that Defendants did not show that Plaintiffs “knew or should 3 have known” that their activity on Noom’s website was being recorded prior to allegedly being 4 wiretapped.); see also Vonbergen v. Liberty Mut. Ins. Co., No. CV 22-4880, 2023 WL 8569004, at 5 *13 (E.D. Pa. Dec. 11, 2023) (finding that although plaintiff “may have consented to Liberty 6 Mutual recording her personal information inputted into the website, she has plausibly alleged that 7 she was not aware Liberty Mutual had procured an undisclosed third party to intercept that 8 information too.”). Here, there is no allegation that Rite Aid or Kaiser tells website users that 9 Salesforce might record their communications. 10 Salesforce’s authority is distinguishable. First, Salesforce relies on Commonwealth v. 11 Proetto for the principle that “there is no expectation of privacy in written electronic 12 communications, because it is understood that any such message, is by its very nature, recorded.” 13 ECF No. 44 at 22; see also ECF No. 46 at 21. However, as the Proetto court explains, “[a]ny 14 reasonably intelligent person, savvy enough to be using the Internet, however, would be aware of 15 the fact that messages are received in a recorded format, by their very nature, and can be 16 downloaded or printed by the party receiving the message.” Com. v. Proetto, 771 A.2d 823, 829 17 (Pa. Super. Ct. 2001), aff’d, 575 Pa. 511 (Pa. 2003) (emphasis added). Proetto is distinguishable 18 from the instant case because while Plaintiffs may have been aware that the “party receiving the 19 message”––i.e., Rite Aid and Kaiser Permanente were receiving the communications in a 20 “recorded format”—they had not consented to an undisclosed third party intercepting the message. 21 None of Salesforce’s other Pennsylvania cases involve an undisclosed third-party. Proetto, 22 771 A.2d at 826 (finding that where the messages were sent directly to a minor, and the minor 23 then forwarded the messages to a detective, there was no interception because the detective’s 24 acquisition of the communications was not contemporaneous with their transmission)8; Com. v. 25

26 8 With regard to communications received directly by the detective when he posed as an underage female, the Proetto court found no violation of the Wiretap Act because he was party to the 27 conversation. Proetto, 771 A.2d at 832. Furthermore, under the WESCA, the term interception, 1 Diego, 119 A.3d 370, 380–81 (Pa. Super. Ct. 2015) (where the recipient of a text message relayed 2 the message to the police, court concluded that there was no interception because the recipient 3 “control[ed] the destiny of the content of that message once it [was] received.”); Com. v. 4 Cruttenden, 619 Pa. 123, 132 (Pa. 2012) (finding no interception even where “officer shields or 5 misrepresents his or her identity, because the caller elects to talk to the officer who answered the 6 phone” and so the officer was the intended recipient of the communications). 7 The remaining question is whether Yockey sufficiently alleges a lack of consent. Plaintiffs 8 allege that Salesforce’s recording “begins the moment a user accesses or interacts with the Chat 9 feature on the Website, prior to a user consenting to any sort of privacy policy or the wiretaps 10 generally,” and that users are not told “prior to being wiretapped, that their electronic 11 communications are being simultaneously directed to Salesforce, as opposed to just the Website 12 customer service agent.” ECF No. 43 ¶ 31 (emphasis added). Yockey also alleges that “users, 13 including Plaintiffs, are thus not on notice of any wiretapping when they begin a Chat interaction, 14 nor do they provide their prior consent to the same.” Id. ¶ 32. Furthermore, Pennsylvania district 15 courts have held that “whether Plaintiffs gave consent to disclosure under the PA Wiretapping Act 16 would appear to be factual in nature––involving issues of factual dispute and interpretation,” and 17 accordingly this Court finds that it is “appropriate to defer ruling on questions about whether 18 Plaintiffs gave consent until after the Parties engage in discovery and develop the factual record.” 19 Braun v. Philadelphia Inquirer, LLC, No. 22-CV-4185-JMY, 2023 WL 7544160, at *5 (E.D. Pa. 20 Nov. 13, 2023). 21 The Court denies Salesforce’s motion to dismiss Plaintiffs’ WESCA claims because 22 Plaintiffs have plausibly alleged that they did not consent to interceptions by an undisclosed third 23 party. 24 D. Extraterritorial Application of CIPA 25 The CIPA contains express geographical limitations. Cal. Pen. Code § 631. Section 631 26 provides for liability where a person “willfully and without the consent of all parties to the 27 communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents 1 any wire, line, or cable, or is being sent from, or received at any place within this state.” Id. 2 (emphasis added). 3 In its motion, Salesforce argued that the CIPA does not apply to Plaintiff Yockey and non- 4 resident members of the putative nationwide class because: (i) non-residents fall outside the 5 CIPA’s stated legislative purpose of protecting the privacy interests of California citizens; (ii) 6 Yockey fails to allege a sufficient California nexus; and (iii) California’s choice-of-law rules 7 preclude application of California law to Yockey and other non-residents. ECF No. 44 at 18–21. 8 In their opposition, Plaintiffs voluntarily withdrew their CIPA Sections 631(a) and 632 claims on 9 behalf of the Nationwide Website Class without prejudice but did not withdraw Plaintiff 10 Magpayo’s individual claims or those of the California website class and Kaiser subclass. ECF 11 No. 45 at 8 n.1. Salesforce argues that these remaining CIPA claims still impermissibly require 12 extraterritorial application because “the California subclass—unlike the Kaiser subclass—is not 13 limited to use of websites at issue while putative subclass members were ‘in California.’” ECF 14 No. 46 at 8 n.1. 15 The California Website Class is “a class of all California residents who used Salesforce’s 16 Chat function on any Website,” and the Kaiser Subclass is “a subclass of all California residents 17 who used Salesforce’s Chat function on Kaiser Permanente’s website while in California.” ECF 18 No. 43 ¶¶ 40, 43. Plaintiffs have also pleaded that “each communication by Plaintiff Magpayo 19 and California Website Class and Kaiser Subclass Members was sent from California and received 20 by Salesforce in California.” Id. ¶ 68. These allegations are sufficient to establish a prima facie 21 case that the communication falls within the ambit of Section 632. Knievel, 393 F.3d at 1072 (9th 22 Cir. 2005). Accordingly, the Court denies Salesforce’s motion to dismiss on extraterritoriality 23 because Plaintiffs have plausibly alleged that the conduct at issue occurred in California. 24 / / / 25 / / / 26 / / / 27 / / / 1 CONCLUSION 2 For the foregoing reasons, Salesforce’s motion to dismiss is denied. 3 IT IS SO ORDERED.

4 Dated: August 16, 2024 ° JON S. TIGAR 6 nited States District Judge 7 8 9 10 11

15 16

it

4 18 19 20 21 22 23 24 25 26 27 28