1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 A.S., individually and on behalf of all Case No.: 3:23-cv-02258-RBM-MSB others similarly situated, et al., 12

ORDER GRANTING DEFENDANT’S

Plaintiffs, 13 MOTION TO DISMISS v. 14 [Doc. 6]

SELECTQUOTE INSURANCE

15

SERVICES,

16 Defendant. 17

18 19 Pending before the Court is Defendant SelectQuote Insurance Services’ 20 (“Defendant”) Motion to Dismiss Plaintiffs A.S., D.G., M.F., and T.M.’s (“Plaintiffs”) 21 Class Action Complaint (“Motion”), which was filed on February 12, 2024. (Doc. 6.) On 22 March 25, 2024, Plaintiffs filed an Opposition to Defendant’s Motion (“Opposition”). 23 (Doc. 7.) On April 1, 2024, Defendant filed a Reply Brief in Support of Defendant’s 24 Motion (“Reply”). (Doc. 8.) 25 The Court finds this matter suitable for determination without oral argument 26 pursuant to Civil Local Rule 7.1(d)(1). For the reasons set forth below, Defendant’s 27 Motion is GRANTED. 28 1 I. BACKGROUND 2 A. Plaintiffs’ Complaint 3 On December 11, 2023, Plaintiffs filed a Class Action Complaint (“Complaint”) 4 against Defendant, alleging causes of action for (1) violations of the California Invasion of 5 Privacy Act (“CIPA”), California Penal Code § 631 (Count I); (2) violations of the CIPA, 6 California Penal Code § 632 (Count II); (3) violations of the Maryland Wiretapping and 7 Electronic Surveillance Act, Maryland Code, Courts and Judicial Proceedings § 10-401, et 8 seq. (Count III); (4) violations of the Massachusetts Wiretapping Statute, Massachusetts 9 General Laws chapter 272 § 99 (Count IV); (5) violations of the Massachusetts Unfair and 10 Deceptive Business Practices Act, Massachusetts General Laws chapter 93A, et seq. 11 (Count V); and (6) violations of the Florida Security of Communications Act, Florida 12 Statute § 934.01, et seq. (Count VI).1 (Doc. 1 (“Compl.”) ¶¶ 46–110.) 13 B. General Allegations 14 In their Complaint, Plaintiffs allege that “[t]his is a class action suit brought on behalf 15 of all persons who [visited Defendant’s website] and received a quote for a life insurance 16 policy.” (Compl. ¶ 1.) Plaintiffs allege that Defendant lets prospective customers receive 17 a life insurance quote by completing a questionnaire that asks for sensitive information, 18 including personal identifying information (e.g., name, email, mailing address, zip code, 19 and phone number), demographic information (e.g., date of birth, gender, state of 20 residency), medical diagnoses and conditions (e.g., cancer, high blood pressure, and 21 diabetes), social habits (e.g., smoking), height, weight, family health history, and financial 22 information (e.g., annual individual income). (Id. ¶¶ 3, 5, 16, 18, 20–24.) Prospective 23 customers communicate their answer by inputting the information and then pressing 24 25

26 27 1 In their Opposition, Plaintiffs withdraw their claim for violations of the Massachusetts Unfair and Deceptive Business Practices Act (Count V). (Doc. 7 at 9 n.2.) Therefore, the 28 1 “next.” (Id. ¶ 26.) Plaintiffs allege that Defendant’s website promises that its site and these 2 entries are “100% secure” and that it will “never sell your information.” (Id. ¶¶ 3, 26.) 3 Plaintiffs then allege that Defendant has “built its website to allow third parties to 4 surreptitiously intercept the information they input.” (Id. ¶ 16.) Plaintiffs also allege that 5 “[Defendant] assists third parties with intercepting every[ ]one of those communications” 6 (id. ¶ 27); that “Defendant shares highly sensitive information with several third parties” 7 (id. ¶ 4); that Defendant “commoditizes and trades” Plaintiffs’ health information (id. ¶ 6); 8 and that “[Defendant] aided, agreed with, and conspired with third parties to track and 9 intercept Plaintiffs’ and Class member’s internet communications while receiving a quote 10 through [Defendant] website” (id. ¶ 51). Plaintiffs appear to allege that the third parties, 11 including LeadID and Facebook, use computer codes, programs, web, ad-servers, and/or 12 tracking technology to intercept Plaintiffs’ communications. (Id. ¶¶ 53, 85, 110.) In 13 support of these allegations, Plaintiffs purport to attached figures showing “network traffic 14 to Facebook and LeadID when a user clicks the button on Defendant’s website indicating 15 that they have issues with alcohol or substance abuse[.]” (Id. ¶ 28.) Plaintiffs then allege 16 that “Facebook and LeadID then leverage this information to target advertisements.” (Id. 17 ¶ 29.) 18 Plaintiffs allege that Facebook allows companies like Defendant to integrate 19 software into their websites that track user activity, like the buttons they click or the forms 20 they complete. (Id. ¶ 30.) The software then relays the information to Facebook, who 21 “assimilates it into existing datasets that Defendant can then use to target advertisements.” 22 (Id.) Likewise, Plaintiffs allege that LeadID is an “interactive direct marketing company,” 23 touting its ability to “target audience[s] effectively.” (Id. ¶ 31 (citations omitted.) “Once 24 LeadID intercepts Plaintiffs’ communications, the company assimilates that information 25 into audiences that Defendant then uses to run advertisements.” (Id.) 26 Plaintiffs allege that they have suffered broken promises, intrusions into their 27 privacy, violations of their rights of privacy, and the loss of value in their personally 28 1 identifiable information. (Id. ¶¶ 7, 54, 72.) Plaintiffs seek an injunction preventing 2 Defendant from perpetrating these abuses on future unsuspecting consumers.2 (Id. ¶ 7.) 3 C. Subclass-Specific Allegations 4 1. Plaintiff A.S. and the California Subclass (Counts I and II) 5 “Plaintiff A.S. seeks to represent a subclass of all Class members in California who 6 accessed [Defendant’s website] and received a quote for life insurance (the ‘California 7 Subclass’).” (Id. ¶ 36.) “Plaintiff A.S. is domiciled in Sylmar, California. While in 8 California, in November 2022, Plaintiff applied for life insurance through [Defendant’s] 9 website. While applying for life insurance, Plaintiff provided [Defendant] with his name, 10 date of birth, gender, and email address. Plaintiff also provided [Defendant] with health 11 information, including that he was diagnosed with depression and anxiety. Unbeknownst 12 to Plaintiff, [Defendant] assisted third parties with intercepting this sensitive information.” 13 (Id. ¶ 10.) 14 2. Plaintiff D.G. and the Maryland Subclass 15 “Plaintiff D.G. seeks to represent a subclass of all Class members in Maryland who 16 accessed [Defendant’s website] and received a quote for life insurance (the ‘Maryland 17 Subclass’).” (Id. ¶ 33.) “Plaintiff D.G. is domiciled in Elkridge, Maryland. While in 18 Maryland, in August 2023, Plaintiff applied for life insurance through [Defendant’s] 19 website. While applying for life insurance, Plaintiff provided [Defendant] with his name, 20 date of birth, gender, and email address. Plaintiff also provided [Defendant] with health 21 information, including that he has been diagnosed with cancer, diabetes, and high blood 22 pressure. Unbeknownst to Plaintiff, [Defendant] assisted third parties with intercepting 23 this sensitive information.” (Id. ¶ 8.) 24

25 2 Although Plaintiffs suggest that they are requesting a preliminary injunction in the 26 introduction of their Complaint, they do not include any cause of action for preliminary 27 injunction and do not allege any facts in support of such a request. Plaintiffs also have not filed a motion for preliminary injunction. Therefore, the Court will not address Plaintiffs’ 28 1 3. Plaintiff M.F. and the Massachusetts Subclass 2 “Plaintiff M.F. seeks to represent a subclass of all Class members in Massachusetts 3 who accessed [Defendant’s website] and received a quote for life insurance (the 4 ‘Massachusetts Subclass’).” (Id. ¶ 34.) “Plaintiff M.F. is domiciled in Winthrop, 5 Massachusetts. While in Massachusetts, in or around February 2023, Plaintiff accessed 6 [Defendant’s] website to complete an application for life insurance. While applying for 7 life insurance, Plaintiff provided [Defendant] with her name, date of birth, gender, and 8 email address. Plaintiff also provided [Defendant] with health information, including that 9 she has been diagnosed with diabetes. Unbeknownst to Plaintiff, [Defendant] assisted third 10 parties with intercepting this sensitive information.” (Id. ¶ 9.) 11 4. Plaintiff T.M. and the Florida Subclass 12 “Plaintiff T.M. seeks to represent a subclass of all Class members in Florida who 13 accessed [Defendant’s website] and received a quote for life insurance (the ‘Florida 14 Subclass’).” (Id. ¶ 35.) “Plaintiff T.M. is domiciled in Orlando, Florida. While in Florida, 15 in or around April 2023, Plaintiff applied for life insurance through [Defendant’s] website. 16 While applying for life insurance, Plaintiff provided [Defendant] with his name, date of 17 birth, gender, and email address. Plaintiff also provided [Defendant] with health 18 information, including that he has high blood pressure. Unbeknownst to Plaintiff, 19 [Defendant] assisted third parties with intercepting this sensitive information.” (Id. ¶ 11.) 20 II. DISCUSSION 21 A. Defendant’s Privacy Policy 22 In its Motion, Defendant explains that “[i]ncluded on each page of the [Defendant’s 23 website] is a hyperlink to [Defendant’s] Privacy Policy to inform visitors that: (1) by using 24 the Site and submitting information to obtain a life insurance policy quote, the user thus 25 ‘explicitly agree[s] to the terms and conditions of the Privacy Policy;’ (2) information users 26 provide to the Site is voluntary and is only collected if a user agrees to voluntarily provide 27 it, such as through the ‘Get Your Free Quote’ or similar pages; and (3) information 28 collected includes personal information.” (Doc. 6-1 at 9–10.) Defendant contends that 1 “[t]he Privacy Policy clearly informs visitors that [Defendant] uses analytics technologies 2 to collect users’ information … [and] … further informs customers that their information 3 may be shared with third parties for various purposes, including marketing services.” (Id. 4 at 10.) Defendant then argues that “[g]iven the Complaint repeatedly references and relies 5 on [Defendant’s] website as the basis for the claims, going so far as to include purported 6 screen shots from the website, it is entirely appropriate that the Court consider the website 7 as a whole, including [Defendant’s] Privacy Policy.” (Id. (citing Copeland v. Techtronics 8 Indus. Co., Ltd., 95 F. Supp. 3d 1230, 1236–37 (S.D. Cal. 2015)).) 9 In their Opposition, Plaintiffs respond that Defendant’s Privacy Policy is not 10 properly before the Court. (Doc. 7 at 8 (citing Copeland, 95 F. Supp. 3d at 1236–37).) 11 Plaintiffs contend that they “are aware of several changes made to [Defendant’s] [w]ebsite 12 since the filing of this lawsuit” and that they “cannot be sure that changes were not also 13 made to Defendant’s [P]rivacy [P]olicy.” (Id.) Plaintiffs also assert that the Court cannot 14 assume the facts contained in the Privacy Policy are true. (Id. at 8–9 (citing Watkins v. 15 MGA Ent., Inc., 550 F. Supp. 3d 815, 829 (N.D. Cal. 2021)).)3 16 The Court construes Defendant’s arguments regarding its privacy policy as a request 17 for incorporation by reference or, alternatively, a request for judicial notice. (See Doc. 6- 18 1 at 10 n.2.) 19 Defendant then argues that “[c]onsent is a complete defense to Plaintiffs’ 20 Wiretapping Acts claims” and that “[a] reasonable website user would have been aware of 21 the [webs]ite’s Privacy Policy[] and understood that by entering information on the 22 [webs]ite, … such information may be shared with third parties.” (Id. at 27.) Plaintiffs 23 respond that Defendant’s privacy policy was not “sufficient to put consumers on notice of 24 the disclosures at issue.” (Doc. 7 at 14–15 (citing Nguyen v. Barnes & Noble Inc., 763 25 F.3d 1171, 1179 (9th Cir. 2014).) 26

27 3 Defendant replies that case law “amply supports” the consideration of Defendant’s 28 1 The Court addresses each issue in turn. 2 1. Incorporation by Reference 3 “Generally, courts may not consider material outside the complaint when ruling on 4 a motion to dismiss” unless the material is incorporated into the complaint by reference or 5 is subject to judicial notice under Federal Rule of Evidence 201. Copelan v. Techtronics 6 Indus. Co., 95 F. Supp. 3d 1230, 1236 (S.D. Cal. 2015) (citing Hal Roach Studios, Inc. v. 7 Richard Feiner & Co., Inc., 896 F.2d 1542, 1555 n.19 (9th Cir. 1990) and Branch v. 8 Tunnell, 14 F.3d 449, 453 (9th Cir. 1994)); see also D’Angelo v. FCA US, LLC, Case No. 9 3:23-cv-00982-WQH-MMP, 2024 WL 1625771, at *4 (S.D. Cal. Mar. 28, 2024) 10 (“Generally, district courts may not consider material outside the pleadings when assessing 11 the sufficiency of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure. 12 … [T]here are two exceptions to this rule: the incorporation-by-reference doctrine, and 13 judicial notice under Federal Rule of Evidence 201.”) (internal quotation marks and 14 citations omitted). Under the incorporation-by-reference doctrine, “‘material which is 15 properly submitted as part of the complaint may be considered.’” Copelan, 95 F. Supp. 3d 16 at 1236 (quoting Hal Roach Studios, Inc., 896 F.2d at 1555, n.19). “Documents specifically 17 identified in the complaint whose authenticity is not questioned by the parties may also be 18 considered.” Id. at 1236–37 (citing Fecht v. Price Co., 70 F.3d 1078, 1080 n.1 (9th Cir. 19 1995)). “Such documents may be considered, so long as they are referenced in the 20 complaint, even if they are not physically attached to the pleading.” Id. (citations omitted). 21 “Moreover, the court may consider the full text of those documents even when the 22 complaint quotes only selected portions.” Id. (citation omitted). In other words, “‘[t]he 23 [incorporation-by-reference] doctrine prevents plaintiffs from selecting only portions of 24 documents that support their claims, while omitting portions of those very documents that 25 weaken—or doom—their claims.’” Stark v. Patreon, Inc., 635 F. Supp. 3d 841, 850 (N.D. 26 Cal. 2022) (quoting Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 27 2018)). 28 1 Here, Plaintiffs reference Defendant’s website throughout their Complaint. (See 2 e.g., Compl. ¶¶ 3, 8–12, 16.) In fact, Plaintiffs incorporate numerous screen shots from 3 Defendant’s website into their Complaint. (See id. ¶¶ 17–26.) As stated above, the Court 4 is permitted to consider “[d]ocuments specifically identified in the complaint whose 5 authenticity is not questioned by the parties[,]” including a website’s privacy policy when 6 the website is referenced in the complaint. Copelan, 95 F. Supp. 3d at 1236–37; see also 7 Stark v. Patreon, Inc., 656 F. Supp. 3d 1018, 1023 (N.D. Cal. 2023) (incorporating privacy 8 policy by reference for the purpose of showing what the defendant’s website disclosed to 9 its users); Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1079 (C.D. Cal. 2021) 10 (taking judicial notice of privacy policy in privacy case because the amended complaint 11 discussed it extensively); In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d 1197, 1207 12 (N.D. Cal. 2014) (incorporating privacy policy referenced in the plaintiffs’ complaint). 13 Therefore, the Court will incorporate Defendant’s privacy policy by reference.4 14 2. Judicial Notice 15 Courts are also permitted to take judicial notice of privacy policies that appear on 16 publicly available websites because their authenticity cannot reasonably be questioned. 17 See e.g., D’Angelo v. FCA US, LLC, 2024 WL 1625771, at *4 (taking judicial notice of 18 privacy policy); Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1061 (N.D. Cal. 2021) 19 (taking judicial notice of a Google’s privacy policies because they are publicly available 20 on websites); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 617 (N.D. Cal. 2021) (finding 21 that privacy policies that appear on publicly available websites and are proper subjects for 22 judicial notice); Javier v. Assurance IQ, LLC, Case No. 4:20-cv-02860-JSW, 2021 WL 23

24 25 4 Plaintiffs attempt to dispute the authenticity of the privacy policy by claiming that Defendant has made several changes to its website since the filing of this lawsuit and that 26 “Plaintiffs cannot be sure that changes were not also made to Defendant’s privacy policy.” 27 (Doc. 7 at 8.) However, Plaintiffs do not submit any evidence supporting this theory, and the privacy policy itself states that its effective date is May 26, 2020, years before the filing 28 1 940319, at *2 (N.D. Cal. Mar. 9, 2021) (taking judicial notice of privacy policy publicly 2 disclosed on defendant’s website); Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1068 3 n.3 (N.D. Cal. 2016) (taking judicial notice of Yelp’s privacy policy publicly disclosed on 4 their website); In re Toll Roads Litig., Case No. SACV 16-00262 AG (JCGx), 2018 WL 5 6131178, at *2 (C.D. Cal. Jan. 12, 2018) (taking judicial notice of privacy policy publicly 6 available on website). Here, Defendant’s privacy policy is publicly available on its 7 website. (See Doc. 6-1 at 10 n.2.) Thus, even if the Court could not incorporate the privacy 8 policy by reference, the Court could still take judicial notice of Defendant’s privacy policy. 9 3. Consent 10 As stated above, Defendant contends that “[i]ncluded on each page of the 11 [Defendant’s website] is a hyperlink to [Defendant’s] Privacy Policy” and “[t]he Privacy 12 Policy clearly informs visitors that [Defendant] uses analytics technologies to collect users’ 13 information … [and] … further informs customers that their information may be shared 14 with third parties for various purposes, including marketing services.” (Doc. 6-1 at 9–10.) 15 However, “[t]he Ninth Circuit has held … that such privacy policies do not bind users: 16 ‘where a website makes its terms of use available via a conspicuous hyperlink on every 17 page of the website but otherwise provides no notice to users nor prompts them to take any 18 affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant 19 buttons users must click on—without more—is insufficient to give rise to constructive 20 notice.’” Yoon, 549 F. Supp. 3d at 1081 (quoting Nguyen, 763 F.3d at 1178–79); see also 21 James v. Allstate Ins. Co., Case No. 3:23-cv-01931-JSC, 2023 WL 8879246, at *5–6 (N.D. 22 Cal. Dec. 22, 2023) (“[E]ven if the Court were to consider the Privacy Policy under the 23 incorporation by reference doctrine, drawing all inferences in Plaintiff’s favor, the website 24 hyperlink failed to disclose a third party’s capture of the Personally Identifiable 25 Information and Personal Health Information. To conclude otherwise would improperly 26 draw inferences in Defendants’ favor.”) (citations omitted); Valenzuela v. Keurig Green 27 Mountain, Inc., 674 F. Supp. 3d 751, 757 (N.D. Cal. 2023) (“Defendant cites no case in 28 which merely hyperlinking to a privacy policy at the bottom of a webpage is sufficient to 1 establish consent under CIPA.”). Additionally, Plaintiffs have alleged Defendant’s website 2 also promises that its site and these entries are “100% secure” and that it will “never sell 3 your information.” (Compl. ¶¶ 3, 26.) Therefore, the Court finds that there is conflicting 4 evidence establishing a question of fact that cannot be resolved at this stage. 5 B. Standing 6 1. Parties’ Arguments 7 Defendant argues that Plaintiffs cannot establish standing. (Doc. 6-1 at 17–18.) 8 Specifically, Defendant argues that “Plaintiffs’ FSCA, MACPA, MAWS, and CIPA … 9 claims do not hint at injury beyond a mere statutory violation,” which is insufficient to 10 establish injury-in-fact. (Id. at 13–14 (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 11 427 (2021)).) Defendant explains that intangible harms, like the loss of privacy Plaintiffs 12 allege here, only rise to the level of Article III injury if they bear a close relationship to 13 harms traditionally recognized by American courts. (Id. at 16.) Defendant then asserts 14 that Plaintiffs’ allegations regarding loss of privacy are not comparable to the common law 15 torts of intrusion upon seclusion because there is no reasonable expectation of privacy 16 when you transmit information over the internet. (Id. at 16–17.) 17 Plaintiffs respond that they have standing because Defendant captured their highly 18 sensitive personal information. (Doc. 7 at 10.) Plaintiffs assert that, prior to the Supreme 19 Court’s decision in TransUnion, the prevailing view was that a plaintiff need not allege 20 harm beyond the invasion of a privacy right conferred by statute. (Id. at 11–12 (citing In 21 re Facebook, Inc., Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (“In re 22 Facebook”)).) Plaintiffs also assert that recent courts applying TransUnion have held that 23 wiretapping is sufficient to establish Article III standing so long as the communications 24 contain private or personal information. (Id. (citing Lightoller v. Jetblue Airways Corp., 25 Case No. 23-cv-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023)).) 26 2. Legal Standard—Federal Rule of Civil Procedure 12(b)(1) 27 “The Court evaluates challenges to Article III standing under Rule 12(b)(1), which 28 governs motions to dismiss for lack of subject matter jurisdiction.” I.C. v. Zynga, Inc., 600 1 F. Supp. 3d 1034, 1046 (N.D. Cal. 2022) (citing Maya v. Centex Corp., 658 F.3d 1060, 2 1067 (9th Cir. 2011)). “Rule 12(b)(1) motions may be either facial, where the inquiry is 3 confined to the allegations in the complaint, or factual, where the court is permitted to look 4 beyond the complaint to extrinsic evidence.” Id. (citing Leite v. Crane Co., 749 F.3d 1117, 5 1121 (9th Cir. 2014) and Safe Air For Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 6 2004)). 7 “When a defendant challenges jurisdiction ‘facially,’ all material allegations in the 8 complaint are assumed true, and the court determines whether the factual allegations are 9 sufficient to invoke the court’s subject matter jurisdiction. When a defendant makes a 10 factual challenge ‘by presenting affidavits or other evidence properly brought before the 11 court, the party opposing the motion must furnish affidavits or other evidence necessary to 12 satisfy its burden of establishing subject matter jurisdiction.’ The court need not presume 13 the truthfulness of the plaintiff’s allegations under a factual attack. The plaintiff must show 14 by a preponderance of the evidence each requirement for subject-matter jurisdiction ….” 15 Id. (internal citations omitted). 16 Additionally, “[i]n a class action, at least one named plaintiff must have standing.” 17 Id. at 1046 (citing Frank v. Gaos, 586 U.S. 485, 492 (2019) and Ollier v. Sweetwater Union 18 High Dist., 768 F.3d 843, 865 (9th Cir. 2014)). “Thus, ‘if none of the named plaintiffs 19 purporting to represent a class establishes the requisite of a case or controversy with the 20 defendant[], none may seek relief on behalf of himself or any other member of the class.’” 21 Id. at 1046–47 (quoting O’Shea v. Littleton, 414 U.S. 488, 494 (1974)). “Moreover, 22 standing must be established ‘for each claim that they press and for each form of relief that 23 they seek (for example, injunctive relief and damages).’” Id. at 1047 (quoting TransUnion 24 LLC, 594 U.S. at 431). Plaintiffs bear the burden of establishing standing. Id. (citations 25 omitted). In the absence of standing, there is no subject matter jurisdiction. Id. (citations 26 omitted). 27 28 1 Here, Defendant appears to pose a facial attack on Article III standing. Therefore, 2 the Court accepts all the allegations alleged in Plaintiffs’ Complaint as true. See I.C., 600 3 F. Supp. 3d at 1046. 4 3. Case Law 5 To establish Article III standing, Plaintiffs “must have (1) suffered an injury in fact, 6 (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely 7 to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 8 338 (2016). “[Plaintiffs], as the party invoking federal jurisdiction, bear[] the burden of 9 establishing these elements.” Id. “Where, as here, a case is at the pleading stage, the 10 plaintiff must ‘clearly ... allege facts demonstrating’ each element.” Id. (quoting Warth v. 11 Seldin, 422 U.S. 490, 518 (1975)). Here, Defendants’ arguments concern the “injury in 12 fact” element, the “first and foremost” of standing’s three elements. Id. at 338–39 13 (quotation omitted). 14 “Injury in fact is a constitutional requirement, and ‘it is settled that Congress cannot 15 erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff 16 who would not otherwise have standing.’” Id. at 339 (quoting Raines v. Byrd, 521 U.S. 17 811, 820 n.3 (1997)) (additional citations omitted). “To establish injury in fact, a plaintiff 18 must show that he or she suffered ‘an invasion of a legally protected interest’ that is 19 ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” 20 Id. (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Thus, “an injury in fact 21 must be both concrete and particularized.” Id. at 340. This case concerns the “concrete” 22 aspect of injury in fact. 23 “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist. When we have 24 used the adjective ‘concrete,’ we have meant to convey the usual meaning of the term 25 ‘real,’ and not ‘abstract.’” Id. (dictionary citations omitted). “‘Concrete’ is not, however, 26 necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to 27 recognize, we have confirmed in many of our previous cases that intangible injuries can 28 nevertheless be concrete.” Id. (citations omitted). 1 In Spokeo, the Supreme Court explained, “[i]n determining whether an intangible 2 harm constitutes injury in fact … it is instructive to consider whether an alleged intangible 3 harm has a close relationship to a harm that has traditionally been regarded as providing a 4 basis for a lawsuit in English or American courts.” Id. at 340–341 (citation omitted). “In 5 addition, because Congress is well positioned to identify intangible harms that meet 6 minimum Article III requirements, its judgment is also instructive and important.” Id. at 7 341. However, “Congress’ role in identifying and elevating intangible harms does not 8 mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a 9 statute grants a person a statutory right and purports to authorize that person to sue to 10 vindicate that right. Article III standing requires a concrete injury even in the context of a 11 statutory violation.” Id. “[A plaintiff] could not, for example, allege a bare procedural 12 violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of 13 Article III.” Id. (citations omitted). 14 Following Spokeo, the Ninth Circuit held that the violation of statutory provisions 15 codifying the substantive right to privacy gives rise to a concrete injury sufficient to confer 16 standing. See In re Facebook, 956 F.3d 589, 598 (9th Cir. 2020). The Ninth Circuit 17 reasoned that the “‘[v]iolations of the right to privacy have long been actionable at common 18 law[,]’” id. (quoting Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir. 2019)), and “[a] 19 right to privacy ‘encompasses the individual’s control of information concerning his or her 20 person[,]’” id. (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)). 21 Shortly thereafter, in TransUnion, the Supreme Court elaborated that “[v]arious 22 intangible harms can also be concrete. Chief among them are injuries with a close 23 relationship to harms traditionally recognized as providing a basis for lawsuits in American 24 courts. Those include, for example, reputational harms, disclosure of private information, 25 and intrusion upon seclusion.” TransUnion LLC, 594 U.S. at 425 (citation omitted) 26 (emphasis added). “Spokeo does not require an exact duplicate in American history and 27 tradition. But Spokeo is not an open-ended invitation for federal courts to loosen Article 28 III based on contemporary, evolving beliefs about what kinds of suits should be heard in 1 federal courts.” Id. at 424–25. “Congress’s creation of a statutory prohibition or obligation 2 and a cause of action does not relieve courts of their responsibility to independently decide 3 whether a plaintiff has suffered a concrete harm under Article III ….” Id. at 426. “[W]e 4 cannot treat an injury as ‘concrete’ for Article III purposes based only on Congress’s say- 5 so.” Id. (quotation omitted). “Congress may enact legal prohibitions and obligations. And 6 Congress may create causes of action for plaintiffs to sue defendants who violate those 7 legal prohibitions or obligations. But under Article III, an injury in law is not an injury in 8 fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory 9 violation may sue that private defendant over that violation in federal court.” Id. at 426– 10 27. 11 The question now facing California district courts handling class action lawsuits 12 similar to the present case is whether the Supreme Court’s decision in TransUnion 13 overruled the Ninth Circuit’s holding in In re Facebook. District courts are split as to 14 whether a plaintiff needs to allege the interception of personal or sensitive information to 15 establish injury-in-fact or whether a violation of CIPA, which codifies the substantive right 16 to privacy, is sufficient. 17 For example, in Lightoller v. Jetblue Airways Corp., the plaintiff alleged that the 18 defendants procured and embedded code in its website to track and analyze her interactions 19 with the website. Case No. 23-cv-00361-H-KSC, 2023 WL 3963823, at *1 (S.D. Cal. June 20 12, 2023). The plaintiff alleged that she visited the defendant’s website to obtain 21 information on flight pricing, but, during her visit, her communications were captured and 22 sent to various software providers. Id. The plaintiff asserted that the defendant’s conduct 23 violated CIPA and constituted the tort of invasion of privacy rights and intrusion upon 24 seclusion. Id. In deciding whether the plaintiff had standing, the district court found that 25 standing based solely on a violation of CIPA was “untenable in light of the Supreme 26 Court’s holding in TransUnion[.]” Id. at *3. The court found that the plaintiff’s allegations 27 were “insufficient to allege a concrete harm that bears a close relationship to the substantive 28 right of privacy (i.e., an individual’s right to control information concerning his or her 1 person)” because the plaintiff did “not allege that she disclosed any personal information 2 when she visited the website.” Id. at *4; see also Byars v. Sterling Jewelers, Inc., No. 5:22- 3 CV-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023) (“Plaintiff does not 4 allege that she disclosed any sensitive information to Defendant, much less identify any 5 specific personal information she disclosed that implicates a protectable privacy interest. 6 She therefore has not identified any harm to her privacy.”); I.C., 600 F. Supp. 3d at 1049– 7 50 (finding the disclosure of basic contact information, e.g., email address, phone number, 8 and username, inadequate to establish Article III standing). Thus, applying the first line of 9 cases, whether Plaintiffs have adequately alleged facts establishing standing hinges on 10 whether plaintiff has alleged the interception of personal or sensitive information. 11 Conversely, in D’Angelo v. FCA US, LLC, the class plaintiffs alleged that the 12 defendant allowed third parties to wiretap and eavesdrop on the chat conversations of all 13 its website visitors by embedding a third-party’s code into its chat feature that records and 14 creates transcripts of all such conversations. Case No. 3:23-cv-00982-WQH-MMP, 2024 15 WL 1625771, at *1 (S.D. Cal. Mar. 28, 2024). The plaintiff alleged that one such third 16 party collected certain data about users and their chat messages, including the user’s 17 account name, the duration of the chat, the user’s geographic location, the user’s network 18 provider, the number of messages sent, the site the user was on before they came to the 19 website, and the amount of time between messages. Id. In deciding whether the class 20 plaintiffs had standing, the district court recognized “that there is a disagreement in this 21 District about whether TransUnion undermined In re Facebook’s holding that a violation 22 of CIPA is sufficient to allege an injury-in-fact.” Id. at *7. However, the district court 23 found that, in the absence of further indication that In re Facebook is overruled, 24 TransUnion did not undermine the Ninth Circuit’s holding in Facebook. Id.; see also 25 Garcia v. Build.com, Inc., Case No. 22-cv-01985-DMS-KSC, 2023 WL 4535531, at *3 26 (S.D. Cal. July 13, 2023) (finding that, unlike a bare procedural violation, a CIPA violation 27 is a violation of substantive privacy rights); id. (reasoning that TransUnion’s holding was 28 not new; it was a reiteration of the Supreme Court’s holding in Spokeo, decided in 2016, 1 before In re Facebook); Licea v. Am. Eagle Outfitters, Inc., 659 F. Supp. 3d 1072, 1078 2 (C.D. Cal. 2023) (same). Thus, applying the second line of cases, Plaintiffs need not allege 3 that the information intercepted was of a personal or sensitive nature. 4 4. Analysis 5 The question now before the Court is whether each named plaintiff suffered an 6 injury-in-fact sufficient to establish Article III standing for his or her subclass. See I.C., 7 600 F. Supp. 3d at 1046. Because each named plaintiff has alleged the interception of 8 personal or sensitive information, including his or her name, date of birth, gender, email 9 address, and health information, under either avenue of decision, the class plaintiffs have 10 alleged facts sufficient to establish standing at this stage. In other words, even under the 11 more stringent requirements set forth in Lightoller, Plaintiffs have established standing, 12 and the Court need not decide whether Plaintiffs need to allege the interception of personal 13 or sensitive information to establish injury-in-fact at this time.5 14 C. Failure to State a Claim 15 1. Legal Standard—Federal Rule of Civil Procedure 12(b)(6) 16 Pursuant to Rule 12(b)(6), an action may be dismissed for failure to allege “enough 17 facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 18 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual 19 content that allows the court to draw the reasonable inference that the defendant is liable 20 for the misconduct alleged. The plausibility standard is not akin to a 21 probability requirement, but it asks for more than a sheer possibility that a defendant acted 22 unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and 23 citations omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s] 24 factual allegations in the complaint as true and construe[s] the pleadings in the light most 25

26 27 5 In their Motion, Defendant also requests that discovery in this case be stayed until the Court finds that Plaintiffs can proceed with their claims. (Doc. 6 at 2.) Having founds that 28 1 favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 2 1025, 1031 (9th Cir. 2008). 3 However, the Court is “not bound to accept as true a legal conclusion couched as a 4 factual allegation.” Ashcroft, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). Nor is 5 the Court “required to accept as true allegations that contradict exhibits attached to the 6 Complaint or matters properly subject to judicial notice, or allegations that are merely 7 conclusory, unwarranted deductions of fact, or unreasonable inferences.” Daniels-Hall v. 8 Nat’l Educ. Ass’n, 629 F.3d 992, 998 (9th Cir. 2010). “In sum, for a complaint to survive 9 a motion to dismiss, the non-conclusory factual content, and reasonable inferences from 10 that content, must be plausibly suggestive of a claim entitling the plaintiff to relief.” Moss 11 v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009) (quotation marks omitted). 12 When a Rule 12(b)(6) motion is granted, “a district court should grant leave to amend 13 even if no request to amend the pleading was made, unless it determines that the pleading 14 could not possibly be cured by the allegation of other facts.” Cook, Perkiss & Liehe v. N. 15 Cal. Collection Serv., 911 F.2d 242, 247 (9th Cir. 1990) (citations omitted). 16 2. Parties’ Arguments 17 Defendant argues that Plaintiffs have failed to state claims under the wiretapping 18 acts referenced in Plaintiffs’ Complaint—CIPA, the Maryland Wiretapping and Electronic 19 Surveillance Act (“MWESA”), the Massachusetts Wiretapping Statute, and the Florida 20 Security of Communications Act (“FSCA”)—which have similar elements and can be 21 addressed together. (Doc. 6-1 at 19–20.) Specifically, Defendant argues that Plaintiffs 22 have not adequately alleged the “interception” of communication, the interception of the 23 “contents” of communications, and that a “device” was used to intercept their 24 communications. (Id. at 21–27.) Plaintiffs respond that they have adequately alleged the 25 “interception” of the “contents” of communications using a “device.” (Doc. 7 at 15–19.) 26 27 28 1 As a preliminary matter, the Court does not agree with Defendants that each statute, 2 which have distinct elements and interpretations thereof, can be addressed together.6 3 Therefore, the Court will address each cause of action in turn. 4 3. CIPA Section 631 (Count I) 5 CIPA section 631(a) states: 6 any person… 7 [1] who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized 8 connection, whether physically, electrically, acoustically, inductively, 9 or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal 10 telephonic communication system, or 11 [2] who willfully and without the consent of all parties to the 12 communication, or in any unauthorized manner, reads, or attempts to 13 read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, 14 line, or cable, or is being sent from, or received at any place within this 15 state;

16 [3] or who uses, or attempts to use, in any manner, or for any purpose, 17 or to communicate in any way, any information so obtained,

18 [4] or who aids, agrees with, employs, or conspires with any person or 19 persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, 20

21 is punishable by a fine….

22 Cal. Pen. Code § 631(a) (number and line breaks added). “The California Supreme Court 23 has explained that this lengthy provision contains three operative clauses covering ‘three 24 distinct and mutually independent patterns of conduct’: (1) ‘intentional wiretapping,’ (2) 25 ‘willfully attempting to learn the contents or meaning of a communication in transit over a 26

27 6 The Court is also not persuaded by the parties’ frequent citations to Pennsylvania law 28 1 wire,’ [i.e., eavesdropping] and (3) ‘attempting to use or communicate information 2 obtained as a result of engaging in either of the two previous activities.’” Mastel v. Miniclip 3 SA, 549 F. Supp. 3d 1129, 1134 (E.D. Cal. 2021) (quoting Tavernetti v. Superior Court, 22 4 Cal. 3d 187, 192 (1978)) (citing In re Google Inc., Case No. 13-MD-02430-LHK, 2013 5 WL 5423918, at *15 (N.D. Cal. Sept. 26, 2013)). In addition, “Section 631(a) … contains 6 a fourth basis for liability, for anyone ‘who aids, agrees with, employs, or conspires with 7 any person or persons to unlawfully do, or permit, or cause to be done any of the’ other 8 three bases for liability.” Id. (quoting Cal. Pen. Code § 631(a)). 9 The Court construes Plaintiffs’ allegations against Defendant as a claim for “aiding 10 and abetting” a third party’s violation of one or all of the first three clauses in violation of 11 the fourth operative clause. (See Compl. ¶ 49 (emphasizing “who aids, agrees with, 12 employs, or conspires”); id. ¶¶ 51–52.) Therefore, “[t]o state a claim under [the fourth] 13 clause, Plaintiff[s] must allege [that a third party] has violated one of the first three clauses 14 of section 631(a), and that Defendant aided, agreed with, employed, or conspired with that 15 person or entity to commit those unlawful acts.” Esparza v. UAG Escondido A1 Inc., Case 16 No. 23cv0102 DMS(KSC), 2024 WL 559241, at *2 (S.D. Cal. Feb. 12, 2024). The Court 17 finds that Plaintiffs have failed to state such a claim for the reasons set forth below. 18 First, Plaintiffs allege that Defendant assists and allows “several third parties,” 19 including LeadID and Facebook, to intercept Plaintiffs’ sensitive personal information. 20 (See Compl. ¶¶ 8–11, 16, 27.) In support of these allegations, Plaintiffs include two figures 21 purportedly showing network traffic from Defendant’s website to LeadID and Facebook. 22 (See Compl. ¶ 28.) However, the text of these figures does not indicate any connection to 23 LeadID or Facebook. (See id.) In fact, the figures appear to show that the “destination” is 24 Defendant’s website. (Id.) Without further support or explanation, the Court finds that 25 Plaintiffs’ conclusory allegation that Defendant assists and allows “several third parties,” 26 including LeadID and Facebook, to “intercept” Plaintiffs’ sensitive personal information 27 is unsupported by sufficient factual allegations. See Ashcroft, 556 U.S. at 678 (The Court 28 is “not bound to accept as true a legal conclusion couched as a factual allegation.”); 1 Daniels-Hall, 629 F.3d at 998 (The Court is not “required to accept as true…allegations 2 that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences 3 ….”). 4 Second, it is not apparent to the Court whether the interceptor—whether it be 5 Facebook, LeadID, or some other third party—is alleged to have violated clauses one, two, 6 three, or some combination thereof. Plaintiffs appear to include allegations pertaining to 7 clause one (see id. ¶ 53), but, at the same time, Plaintiffs do not quote the entirety of clause 8 one in their Complaint (see id. ¶ 49). The Court also notes that California district courts 9 have held that clause one does not apply to internet communications like the ones alleged 10 here. See also UAG Escondido A1 Inc., 2024 WL 559241, at *2 (“[C]lause one does not 11 apply to internet connections.”); Esparza v. Gen Digital Inc., Case No. CV 23-8223-KK- 12 AGRx, 2024 WL 655986, at *3 (C.D. Cal. Jan. 16, 2024) (“[B]ecause Section 631(a) 13 concerns telephonic wiretapping, it does not apply to the context of the internet[.]”) 14 (internal quotation marks and citation omitted); Heiting v. Taro Pharms. USA, Inc., Case 15 No. 2:23-cv-08002-SPG-E, 2023 WL 9319049, at *2 (C.D. Cal. Dec. 26, 2023) 16 (“[B]ecause Plaintiff alleges interception of a chat communication on Defendant’s website, 17 instead of over the phone, Plaintiff cannot state a claim under the first clause of section 18 631(a).”). 19 Relatedly, as written, it is not apparent to the Court whether the alleged software, 20 code, or tracking technology is owned and operated by Facebook or LeadID, or whether a 21 third-party software provider “relays” the sensitive personal information to Facebook or 22 LeadID. (See Compl. ¶ 30 (“Facebook allows those companies to integrate software into 23 their websites, software that tracks user activity, like the buttons they click or the forms 24 they complete. That software then relays that information to Facebook, and once that 25 information is received, the social media site assimilates it into existing databases that 26 Defendant can then use to target advertisements.”).) This distinction informs whether 27 Facebook or LeadID is alleged to have violated clause two or clause three. 28 1 Because Plaintiffs have not adequately alleged that any third party unlawfully 2 wiretapped or eavesdropped on Plaintiffs’ communications in violation of CIPA section 3 631(a)—whether it be clause one, clause two, or clause three—the Court cannot find that 4 Plaintiffs adequately alleged that Defendant aided and abetted any such violation. See 5 UAG Escondido A1 Inc., 2024 WL 559241, at *2. Thus, Plaintiffs’ claim for violations of 6 CIPA section 631(a) is DISMISSED WITH LEAVE TO AMEND. 7 4. CIPA Section 632 (Count II) 8 Section 632.7(a) prohibits the interception or recording of communications between 9 two phones: 10 Every person who, without the consent of all of the parties to a communication, intercepts or receives and intentionally records, or assists in 11 the interception or reception and intentional recordation of, a communication 12 transmitted between two cellular radio telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a cordless telephone and 13 a landline telephone, or a cordless telephone and a cellular radio telephone, 14 shall be punished by a fine …, or by imprisonment in a county jail ….

15 Cal. Pen Code § 632.7(a) (emphasis added). The majority of district courts addressing this 16 issue have held that section 632.7(a) applies only to communications between two 17 telephones and not to internet communications. See e.g., Keurig Green Mountain, Inc., 18 674 F. Supp. 3d at 760 (“[Section] 632.7 unambiguously limits its reach to communications 19 between various types of telephones.”); Am. Eagle Outfitters, Inc., 659 F. Supp. 3d at 1112 20 (“The Court determines that section 632.7 only applies to the five types of calls enumerated 21 ….”); Byars v. Hot Topic, Inc., 656 F. Supp. 3d 1051, 1069 (C.D. Cal. 2023) (“The 22 unambiguous meaning of the statute is thus that it only applies to communications 23 involving two telephones. Plaintiff’s allegations all relate to text-based web 24 communications regarding a chat feature on a website, which virtually by definition cannot 25 involve two telephones.”); Build.com, Inc., Case No. 22-cv-01985-DMS-KSC, 2023 WL 26 4535531, at *6 (S.D. Cal. July 13, 2023) (“A plain reading of the text makes clear that the 27 statute only applies to communications transmitted by telephone, not internet. Plaintiffs 28 seem to argue that Defendant’s conduct violated Section 632.7 because Plaintiffs’ 1 communications with Defendant through the website chat function on her smart phone 2 amounted to ‘communication ... transmitted via telephony.’ This stretches the statutory 3 language too far.”); Martin v. Sephora USA, Inc., Case No. 1:22-cv-01355-JLT-SAB, 2023 4 WL 2717636, at *17 (E.D. Cal. Mar. 30, 2023) (“[T]he Court concludes that § 632.7 only 5 applies to the five types of calls previously enumerated.”); but see Licea v. Old Navy, LLC, 6 669 F. Supp. 3d 941, 947 (C.D. Cal. 2023) (finding that only one party need be using a 7 telephone to bring it in the purview of section 632.7 and that smartphones fall within the 8 cellular phone category); Byars v. Goodyear Tire & Rubber Co., 654 F. Supp. 3d 1020, 9 1027–28 (C.D. Cal. 2023) (same). 10 The Court joins the majority of California district courts in finding that section 632 11 does not apply to internet communications. See Rodriguez v. Ford Motor Co., Case No. 12 3:23-cv-00598-RBM-JLB, 2024 WL 1223485, at *17 (S.D. Cal. Mar. 21, 2024) (R. 13 Montenegro). Therefore, Plaintiffs have not adequately alleged violations of CIPA section 14 632. Because amendment would be futile, the Court DISMISSES this claim WITHOUT 15 LEAVE TO AMEND. See Cook, Perkiss & Liehe, 911 F.2d at 247. 16 5. Maryland Wiretapping and Electronic Surveillance Act 17 “[I]t is unlawful for any person to: (1) Willfully intercept, endeavor to intercept, or 18 procure any other person to intercept or endeavor to intercept, any wire, oral, or electronic 19 communication; (2) Willfully disclose, or endeavor to disclose, to any other person the 20 contents of any wire, oral, or electronic communication, knowing or having reason to know 21 that the information was obtained through the interception of a wire, oral, or electronic 22 communication in violation of this subtitle; or (3) Willfully use, or endeavor to use, the 23 contents of any wire, oral, or electronic communication, knowing or having reason to know 24 that the information was obtained through the interception of a wire, oral, or electronic 25 communication in violation of this subtitle.” Md. Code Ann., Cts. & Jud. Proc. § 10-402. 26 Maryland federal courts have had limited opportunity to apply MWESA to internet 27 communications like the ones alleged here. See e.g., Curd v. Papa John’s Int’l, Inc., 692 28 F. Supp. 3d 525, 531 (D. Md. 2023) (“Even if Plaintiff’s use of Papa John’s website creates 1 a potential cause of action … Plaintiff fails to allege facts that support this court’s exercise 2 of personal jurisdiction over Papa John’s.”). Nevertheless, it is clear from the statute’s text 3 that violations of MWESA depend upon the “willful” “interception” of “any wire, oral, or 4 electronic communication[.]” See Md. Code Ann., Cts. & Jud. Proc. § 10-402. 5 Defendant argues that Plaintiffs have not plausibly alleged “interception” of a 6 communication, an essential element under each wiretapping act. (Id. at 21–23.) 7 Specifically, Defendant argues that Plaintiffs allege “interception” “in conclusory terms 8 that do not satisfy Iqbal or Twombly” and that using the word “intercept” throughout the 9 Complaint is not enough without the addition of specific facts supporting Plaintiffs’ theory 10 that Defendant is “intercepting” Plaintiffs’ data. (Id. at 21–22.) Defendant also contends 11 that Plaintiffs’ passing references to “tracking technologies” and “software” is insufficient 12 to explain how Defendant is allegedly intercepting Plaintiffs’ data. (Id. at 22.) 13 Plaintiffs respond that they have adequately alleged that Defendant allows third 14 parties, like LeadID and Facebook, to intercept Plaintiffs’ electronic communications, such 15 as the buttons that they click and the forms they complete. (Doc. 7 at 16.) Plaintiffs 16 contend that they illustrate the interceptions occurring in real time by providing an example 17 showing network traffic to Facebook and LeadID when a website user clicks the button on 18 Defendant’s website indicating that they have issues with alcohol or substance abuse. (Id.) 19 Plaintiffs contend that “[s]uch interceptions occur for every communication with the 20 website.”7 21 For the same reasons set forth above (see Section II.C.2.a), the Court agrees with 22 Defendants that, without further support or explanation, Plaintiffs’ conclusory allegations 23 regarding “interception” are insufficient at this stage. See Ashcroft, 556 U.S. at 678; 24 Daniels-Hall, 629 F.3d at 998. Thus, Plaintiffs have not stated a claim under MWESA, 25 and the Court DISMISSES this claim WITH LEAVE TO AMEND. 26

27 7 Defendant’s Reply re-states its position that Plaintiffs do not adequately allege 28 1 a) Massachusetts Wiretapping Statute 2 “[A]ny person who—willfully commits an interception, attempts to commit an 3 interception, or procures any other person to commit an interception or to attempt to 4 commit an interception of any wire or oral communication shall be fined not more than ten 5 thousand dollars, or imprisoned in the state prison for not more than five years, or 6 imprisoned in a jail or house of correction for not more than two and one half years, or both 7 so fined and given one such imprisonment.” Mass. Gen. Laws Ann. ch. 272, § 99. “The 8 term ‘interception’ means to secretly hear, secretly record, or aid another to secretly hear 9 or secretly record the contents of any wire or oral communication through the use of any 10 intercepting device by any person other than a person given prior authority by all parties to 11 such communication[.]” Id. As in Maryland, Massachusetts federal courts have had 12 limited opportunity to apply the Massachusetts Wiretapping Statute to internet 13 communications. See e.g., Rosenthal v. Bloomingdale’s, Inc., 686 F. Supp. 3d 36, 40 (D. 14 Mass. 2023) (dismissing similar case for lack of personal jurisdiction); Alves v. Goodyear 15 Tire & Rubber Co., 683 F. Supp. 3d 111, 120 (D. Mass. 2023) (same). However, it is clear 16 from the statutory text that, at a minimum, Plaintiffs must allege the “willful” “interception 17 of any wire or oral communication[.]” Mass. Gen. Laws Ann. ch. 272, § 99. 18 For the same reasons set forth above (see Section II.C.2.a), the Court agrees with 19 Defendants that, without further support or explanation, Plaintiffs’ conclusory allegations 20 regarding “interception” are insufficient at this stage. See Ashcroft, 556 U.S. at 678; 21 Daniels-Hall, 629 F.3d at 998. Thus, Plaintiffs have not stated a claim under the 22 Massachusetts Wiretapping Statute, and the Court DISMISSES this claim WITH LEAVE 23 TO AMEND. 24 b) Florida Security of Communications Act 25 “Any person whose wire, oral, or electronic communication is intercepted, disclosed, 26 or used in violation of ss. 934.03-934.09 shall have a civil cause of action against any 27 person or entity who intercepts, discloses, or uses, or procures any other person or entity 28 to intercept, disclose, or use, such communications ….” Fla. Stat. Ann. § 934.10. Put 1 simply, “[t]he FSCA provides a cause of action against parties that intercept or use private 2 communications without the speaker’s consent.” Goldstein v. Costco Wholesale Corp., 3 559 F. Supp. 3d 1318, 1319–20 (S.D. Fla. 2021). Thus, for the same reasons set forth 4 above (see Section II.C.2.a), the Court agrees with Defendants that, without further support 5 or explanation, Plaintiffs’ conclusory allegations regarding “interception” are insufficient 6 at this stage. See Ashcroft, 556 U.S. at 678; Daniels-Hall, 629 F.3d at 998. 7 Further, Florida district courts have found that the FSCA does not apply to session 8 replay software, software that records a website users’ mouse clicks, keystrokes, search 9 terms, and information inputted into the website. See Cardoso v. Whirlpool Corp., Case 10 No. 21-CV-60784-WPD, 2021 WL 2820822, at *2 (S.D. Fla. July 6, 2021) (finding that 11 FSCA does not apply to the plaintiff’s claims regarding session replay technology software 12 on a commercial website and that, even so, the plaintiff failed to adequately allege 13 sufficient facts supporting the elements of an FSCA violation); Goldstein v. Luxottica of 14 Am., Inc., Case No. 21-80546-CIV-CANNON/REINHART, 2021 WL 4093295, at *3 15 (S.D. Fla. Aug. 23, 2021) (“[T]he FSCA does not extend to the session replay software.”); 16 Swiggum v. EAN Servs., LLC, Case No. 8:21-cv-493-TPB-CPT, 2021 WL 3022735, at *2 17 (M.D. Fla. July 16, 2021) (“Because the Court has concluded that the FSCA does not apply 18 to Plaintiff’s session replay technology claims, it appears that amendment is futile. 19 However, in an abundance of caution, the Court will grant leave for Plaintiff to file an 20 amended complaint, if she may do so in good faith.”). This session replay software appears 21 similar in kind to the software, code, or tracking technology Plaintiffs allege here. (See 22 Compl. ¶ 30 (alleging “software that tracks user activity, like the buttons they click”).) 23 Therefore, Plaintiffs have failed to state a claim under FSCA, and the Court DISMISSES 24 this claim WITH LEAVE TO AMEND. 25 /// 26 /// 27 /// 28 /// 1 it. CONCLUSION 2 Based on the foregoing, Defendant’s Motion to Dismiss is GRANTED. Plaintiffs 3 file an amended complaint on or before September 2, 2024. 4 ISSO ORDERED. 5 ||DATE: August 19, 2024

7 ONY RUTH BERMUBEZ MONTENEGRO

UNITED STATES DISTRICT JUDGE

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28