1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ERICA FRASCO, et al., Case No. 21-cv-00757-JD

8 Plaintiffs,

ORDER RE SUMMARY JUDGMENT

v. 9

10 FLO HEALTH, INC., et al., Defendants. 11

12 13 In this putative class action, named plaintiffs Erica Frasco, Sarah Wellman, Justine 14 Pietrzyk, Jennifer Chen, Tesha Gamino, Leah Ridgway, Autumn Meigs, and Madeline Kiss sued 15 Flo Health, Inc. (Flo) and Google LLC (Google), among others, over Flo’s use of Google’s 16 analytics services in connection with the Flo Period & Ovulation Tracker app for women (Flo 17 App). See Dkt. No. 64 (first amended complaint). Plaintiffs alleged a panoply of federal- and 18 state-law privacy claims and claims of unfair competition under California law, against Google. 19 See id. at 77-87. After the close of fact discovery, Google moved for summary judgment. See 20 Dkt. Nos. 338-39. Plaintiffs timely opposed. See Dkt. Nos. 348-49, 51. The parties’ familiarity 21 with the record is assumed, and summary judgment is granted in part. 22 DISCUSSION 23 I. STANDING 24 The parties’ briefs indicate a misunderstanding about a prior order with respect to 25 Article III standing to sue. The Court dismissed the claims against defendant AppsFlyers on the 26 ground that plaintiffs had “not adequately alleged a concrete and particularized injury caused by 27 AppsFlyer” because “AppsFlyer [was] not said to have used the data collected from the Flo App 1 ask for summary judgment on all plaintiffs’ claims on the grounds that there is no evidence it 2 “receive[d] any sensitive health information from Flo” or “use[d] the data it received from the Flo 3 App for research, development, marketing, or advertising purposes.” Dkt. No. 339-3 at 15-16. 4 Google goes too far. Plaintiffs’ claims are premised on the allegation that Google violated 5 their privacy rights by obtaining and storing, without plaintiffs’ knowledge or consent, sensitive 6 personal information from the Flo App via the Google software developer kit (SDK). See Dkt. 7 No. 64 at 77-87. Violations of the right to privacy, which “encompass[es] the individual’s control 8 of information concerning his or her person,” “have long been actionable at common law.” In re 9 Facebook, Inc. Internet Tracking Litigation (Facebook Tracking), 956 F.3d 589, 598 (9th Cir. 10 2020) (alteration in original) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 11 2017), and Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir. 2019)). The statutory and common- 12 law causes of action that plaintiffs allege protect “substantive right[s] to privacy, the violation of 13 which gives rise to a concrete injury sufficient to confer standing.” Id.; see also Campbell v. 14 Facebook, Inc., 951 F.3d 1106, 1117-19 (9th Cir. 2020). Consequently, plaintiffs need not adduce 15 evidence that the private information was “used” or further disclosed by Google. See Campbell, 16 951 F.3d at 1118; Eichenberger, 876 F.3d at 983; In re Facebook Tracking, 956 F.3d at 598-99. 17 There are genuine disputes of material fact bearing on whether plaintiffs have suffered an 18 injury in fact from Google having collected their private health information. For example, the 19 parties hotly disagree whether the information Google obtained via the SDK contains private 20 health information. See, e.g., Dkt. Nos. 338-14 at 125:2-8; 351-15; 351-16; 351-17. Similar 21 disputes of fact abound with respect to whether plaintiffs’ alleged injury is traceable to Google. 22 The record indicates that Google provided the SDK for free to obtain data from third-party apps, 23 among other reasons, see, e.g., Dkt. Nos. 338-4 at 2; 348-10 at 2; 351-31 at 2-5; 351-5 at 2, and 24 that the disclosure of the Flo App data was made possible by Google’s SDK, see, e.g., Dkt. Nos. 25 351-5 at 2-8; 351-31 at 2-5; 348-10 at 2-3. The parties dispute whether Google actively solicited 26 Flo’s business to obtain sensitive health data and adhered to its own privacy policies in connection 27 with the Flo App. See Dkt. Nos. 351-42; 338-1 ¶ 6; 351-45 at ECF 2; 338-30 at 11:2-25, 12:1-20; 1 Google says that plaintiffs could not have suffered a privacy injury because any 2 information it collected “was not tied to Plaintiffs’ GAIA IDs or any identifying information.” 3 Dkt. No. 339-3 at 17. But it is not at all clear that the collection of information about a woman’s 4 menstruation cycles and fertility goals without consent is permissible just because Google says it 5 didn’t connect the information to a particular person. Google certainly did not cite any case law to 6 that effect, and Ninth Circuit precedent suggests otherwise. See Campbell, 951 F.3d at 1119, 1119 7 n.9 (stating that Facebook’s argument that plaintiffs “suffered no concrete harm from the ‘use of 8 anonymized and aggregated data’” was “beside the point” because Facebook “identifies and 9 collects the contents of users’ individual private messages” and “Plaintiffs’ position [was that] this 10 was done without consent” (emphasis in original)). In addition, plaintiffs have adduced evidence 11 to establish a material dispute of fact with respect to whether the information collected was or 12 could be tied to identifying information, see Dkt. Nos. 351-22 at ECF 2; 351-12 at 18-20; 351-24 13 at ECF 4; 351-20 at ECF 13.1 14 II. CONSENT 15 For present purposes, Google hangs its hat for the defense of consent solely on plaintiffs’ 16 acceptance of Flo’s privacy policies. See Dkt. No. 339-3 at 12-13, 18-19. Consent may be a 17 defense when it is “actual,” and it “is only effective if the person alleging harm consented ‘to the 18 particular conduct, or to substantially the same conduct’ and if the alleged tortfeasor did not 19 exceed the scope of that consent.” Calhoun v. Google, LLC, --- F.4th ---, No. 22-16993, 2024 WL 20 3869446, at *5 (9th Cir. Aug. 20, 2024) (quotations omitted). 21 As these principles indicate, consent is typically a fact-bound inquiry, and the record 22 before the Court demonstrates a number of factual disputes that preclude summary judgment on 23 this score. As discussed herein, there are disputes of fact about the scope of the information that 24 Google obtained from the Flo App, and the uses of that data, if any. The parties also highlight 25

26 1 Google says that the record demonstrates that Google “could not find[] any data associated with Plaintiffs.” Dkt. No. 360 at 10. While that is a creative interpretation of Google’s own evidence, 27 see Dkt. No. 338-16 at ECF 7 (“Based on Google’s investigation to date, there is no Flo App Data 1 different portions of various privacy policies over the years to disagree about the scope of 2 plaintiffs’ consent to sharing data with Google. See, e.g., Dkt. Nos. 339-3 at 9-10; 351-3 at 13-14, 3 22-23. Consequently, the Court cannot assess whether a “reasonable user reading [the Flo App’s 4 privacy policies] would [have thought] that he or she was consenting” to Google’s collection 5 practices until a jury resolves those factual disputes. See Calhoun, --- F.4th at ---, 2024 WL 6 6869446, at *6. 7 III. STATUTORY STANDING FOR UCL AND CDAFA 8 Counts Nine, Ten, and Fourteen of the operative complaint allege that Google violated the 9 California Unfair Competition Law (UCL), Cal. Bus. & Prof. Code § 17200 et seq.; aided and 10 abetted Flo’s violation of the UCL; and violated the California Comprehensive Computer Data 11 Access and Fraud Act (CDAFA), Cal. Penal Code § 502. See Dkt. No. 64 at 77-80, 85-87. 12 Google says that plaintiffs lack statutory standing under the UCL and CDAFA and so these claims 13 should be dismissed. See Dkt. No. 339-3 at 20-21. 14 Summary judgment is granted in Google’s favor on the UCL and UCL-based aiding-and- 15 abetting claims because plaintiffs abandoned the defense of their UCL claims. See Dkt. No. 351-3 16 at 17-18, 17 n.18. It is denied as to the CDAFA claim because Google did not carry its burden for 17 summary judgement. 18 CDAFA is the California state law analog of the federal Computer Fraud and Abuse Act 19 (CFAA), 18 U.S.C. § 1030 et seq. Like the CFAA, CDAFA provides a private cause of action 20 against any person who “[k]knowingly accesses and without permission uses or causes to be used 21 computer services” or “accesses or causes to be accessed any computer, computer system, or 22 computer network.” Cal. Pen. Code §§ 502(c)(3), (7) & (e)(1). To sue under CDAFA, a plaintiff 23 must have suffered “damage or loss by reason of a [CDAFA] violation.” Cal. Pen. Code 24 § 502(e)(1). Google’s main contention on summary judgment is that an “intangible invasion of 25 privacy” without a loss of income or other “actual” injury is not “damage or loss” as contemplated 26 by CDAFA. See Dkt. No. 339-3 at 21 (citing Williams v. Facebook, Inc., 384 F. Supp. 3d 1043, 27 1050 (N.D. Cal. 2018)). 1 The point is not well taken. The plain language of CDAFA is not as definitive as Google 2 urges. See Cal. Pen. Code § 502(a) (“The Legislature further finds and declares that protection of 3 . . . lawfully created computers, computer systems, and computer data is vital to the protection of 4 the privacy of individuals”). In addition, even giving Google’s interpretation the benefit of the 5 doubt, plaintiffs have adduced evidence from which a reasonable jury could conclude that the 6 information obtained by Google “carried financial value” that amounts to damage or loss suffered 7 by plaintiffs. See Dkt. Nos. 359-75 at ECF 10-11, 14-19; 359-31 at ECF 3; 359-5 at ECF 2; 359- 8 61 at ECF 2-3. Summary judgment is denied on the CDAFA claim. 9 IV. AIDING AND ABETTING 10 Summary judgment is granted in favor of Google on the claim that it aided and abetted 11 Flo’s intrusion upon plaintiffs’ seclusion. Under California law, aiding and abetting “necessarily 12 requires a defendant to reach a conscious decision to participate in tortious activity for the purpose 13 of assisting another in performing a wrongful act.” Howard v. Superior Court, 2 Cal. App. 4th 14 745, 749 (1992). California courts have concluded that ordinary business transactions may 15 “satisfy the substantial assistance element of an aiding and abetting claim if the [commercial 16 vendor] actually knew those transactions were assisting the customer in committing a specific 17 tort.” Casey v. U.S. Bank Nat’l Ass’n, 127 Cal. App. 4th 1138, 1145 (2005). Consequently, 18 Google might be liable for aiding and abetting by providing the SDK to Flo only if there were 19 evidence that Google had actual knowledge of Flo’s deceptive disclosure practices with respect to 20 plaintiffs’ private health information. 21 The record presented to the Court is devoid of such facts. Plaintiffs did not identify “with 22 reasonable particularity” a non-speculative basis in the record from which a jury could conclude 23 that Google had the requisite knowledge. Metro. Life Ins. Co. v. Oyedele, No. 21-cv-04607, 2014 24 WL 6985079, at *3 (N.D. Cal. Dec. 10, 2014) (citing Keenan v. Allan, 91 F.3d 1275, 1279 (9th 25 Cir. 1996)). Plaintiffs’ suggestion that Google could have used data obtained by Flo, see Dkt. No. 26 351-3 at 7-8, does not fill in the gap. So too for whether Google used the data for its machine- 27 learning programs and products. See Dkt. Nos. 351-31 at ECF 3-4; 351-34 at ECF 66; 351-61 at 1 Flo in committing a tort. Plaintiffs point to business meetings and pitches between Flo and 2 Google, see, e.g., Dkt. Nos. 351-45 at 35:2-25; 351-46; 351-42, but these entirely generic events 3 also do not provide non-speculative evidence that Google knew of Flo’s tortious conduct. The 4 same goes for evidence indicating that Google helped Flo advertise to women who were pregnant 5 or trying to get pregnant. That was the whole point of Flo’s fertility app and does not in itself 6 indicate an aiding-and-abetting scheme. See Dkt. Nos. 351-47 at ECF 3; 351-48 at ECF 3 (email 7 about “launch[ing] a campaign or an ad group to work [the] particular group” of “get pregnant” 8 from a Flo employee in “Lead User Acquisition”). 9 Plaintiffs’ reliance on emails after the putative class period is equally misplaced. It may be 10 that Flo and Google employees exchanged emails about Google Ad campaigns targeting Flo users 11 who were “TTC” (trying to conceive, according to plaintiffs), see Dkt. No. 351-50 at ECF 2, but 12 that is not a basis from which a reasonable jury could find aiding-and-abetting knowledge. The 13 cases on which plaintiffs rely concerned the plausibility of inferring knowledge from allegations in 14 the operative complaint. See Sihler v. Fulfillment Lab, Inc., No. 20-cv-01528, 2021 WL 1293839, 15 at *7 (S.D. Cal. Apr. 7, 2021) (concluding that it was “plausible” that the entity assisting with 16 advertising would have “knowledge of the content of the advertisements and the nature of the 17 campaign”); Opperman v. Path, Inc., 84 F. Supp. 3d 962, 986 (N.D. Cal. 2015). At summary 18 judgment, the relevant question is not the plausibility of knowledge but the existence of evidence 19 tending to show it. 20 V. CIPA AND WIRETAP ACT CLAIMS 21 Summary judgment is denied on plaintiffs’ claims under the Federal Wiretap Act, 22 18 U.S.C. § 2511,2 and the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 630 et 23 seq. Google says that: (1) the alleged interception was not purposeful; (2) Google was acting only 24 as a “vendor”; and (3) any asserted recording was performed by Flo, not Google. See Dkt. No. 25 339-3 at 23-25. 26 27 1 Disputes of fact about these issues preclude summary judgment. Google concedes that the 2 analysis for a violation of CIPA tracks the analysis under the federal Wiretap Act, which the Court 3 will accept as true for present purposes. See Dkt. No. 339-3 at 24. For the Wiretap Act, “the 4 || operative question under § 2511 is whether the defendant acted consciously and deliberately with 5 || the goal of intercepting wire communications.” United States v. Christensen, 828 F.3d 763, 775 6 (9th Cir. 2015). The factual disputes that barred summary judgment with respect to the alleged 7 transmission of data via Google’s SDK, and its subsequent use vel non, apply here to the same 8 || end. 9 CONCLUSION 10 Summary judgment is granted in favor of Google on plaintiffs’ UCL and aiding-and- 11 abetting claims. It is denied in all other respects. 12 IT IS SO ORDERED. 13 Dated: September 23, 2024 14 15

JAMBB DONATO

= 16 Unitgg States District Judge

18 19 20 21 22 23 24 25 26 27 28