1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 R.C., et al., Case No. 24-cv-02609-JSC

8 Plaintiffs,

ORDER RE DEFENDANT’S MOTION

9 v. TO DISMISS PLAINTIFFS’ THIRD

CAUSE OF ACTION

10 SUSSEX PUBLISHERS, LLC, Re: Dkt. No. 57 Defendant. 11

12 13 Plaintiffs R.C. and D.G. bring this putative class action against Sussex Publishers, LLC 14 claiming it disclosed and mishandled their private and medical information in violation of 15 California law. (Dkt. No. 55.)1 The Court previously denied in large part Defendant’s motion to 16 dismiss Plaintiffs’ Second Amended Complaint (“SAC”), but it dismissed Plaintiff’s California 17 Penal Code § 631 claim with leave to amend. (Dkt. No. 51.) Plaintiffs’ third amended complaint 18 (“TAC”) realleges this claim and Defendant now moves to dismiss only this claim. (Dkt. Nos. 55, 19 57.) After carefully considering the arguments and briefing submitted, the Court concludes oral 20 argument is unnecessary, see Civ. L.R. 7-1(b), and DENIES Defendant’s motion. 21 A. Background 22 Plaintiffs have sought to bring a Penal Code § 631 claim for aiding and abetting liability in 23 every iteration of their complaint. (Dkt. Nos. 1, 16, 36, 55.) The Court granted Defendant’s 24 motion to dismiss the Penal Code § 631 claim in the first amended complaint (“FAC”), holding 25 the FAC failed to sufficiently plead the “in transit” element of that claim. (Dkt. No. 39 at 28-29.) 26 Plaintiffs’ SAC realleged the claim, but the Court dismissed again: 27 1 Plaintiffs do not plausibly allege Google views or reads the information while it is in transit; instead, they allege information is 2 sent “to Google for processing” and later, “[o]nce Google Analytics receives, views, reads, and processes the data, it aggregates and 3 organizes the data based on particular criteria.” ([Dkt. No. 36] ¶ 43.) These allegations do not support a plausible inference Google reads 4 the information “while the same is in transit.” See Licea v. Cinmar, LLC, 659 F. Supp. 3d 1096, 1110 (C.D. Cal. 2023) (dismissing section 5 631 claim when “[t]he timeline of the automatic recording and transcription is unclear.”). 6 (Dkt. No. 51 at 13.) Plaintiffs’ TAC realleges this claim once more, and Defendant moves to 7 dismiss on the grounds Plaintiffs still do not plausibly state a § 631 claim. 8 B. Whether Plaintiffs Plausibly Plead a CIPA § 631 Claim for Aiding and Abetting 9 California Penal Code § 631 “prescribes criminal penalties for three distinct and mutually 10 independent patterns of conduct.” Tavernetti v. Superior Ct., 22 Cal. 3d 187, 192 (1978).2 11 Section 631 also imposes liability “on anyone who aids, agrees with, employs, or conspires with 12 any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things 13 mentioned above.” Swarts v. HomeDepot, Inc., 689 F. Supp. 3d 732, 743 (N.D. Cal. 2023) 14 (quoting Cal. Penal Code § 631). To adequately plead a § 631 civil aiding-and-abetting cause of 15 action, a party must plead “an underlying predicate violation” by the aided party. B.K. Desert 16 Care Network, No. 23-cv-05021-SPG (PDx), 2024 WL 1343305, at *7 (N.D. Cal. Feb. 1, 2024). 17 These possible predicate violations are: 18 (1) when a person “by means of any machine, instrument, or 19 contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection … with any telegraph or telephone wire, 20 line, cable, or instrument,”

21 (2) when a person “willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to 22 read, or to learn the contents or meaning of any message, report, or communication while the same is in transit,” or 23 (3) when a person “uses, or attempts to use, in any manner, or for any 24 purpose, or to communicate in any way, any information so obtained.” 25 Yockey v. Salesforce, 688 F. Supp. 3d 962, 970 (N.D. Cal. 2023) (quoting Cal. Penal Code § 631). 26 27 1 Plaintiffs previously conceded the first clause “does not apply to the internet, and so cannot 2 support [Plaintiffs’] claims.” Cody v. Ring LLC, 718 F. Supp. 3d 993, 999 (N.D. Cal. 2024); (Dkt. 3 No. 43 at 26.) And a party must allege one of the first two clauses to adequately plead the third. 4 Tavernetti, 22 Cal. 3d at 192 (holding the third clause proscribes “attempting to use or 5 communicate information obtained as a result of engaging in either of the previous two 6 activities.”). So, the issue is whether Plaintiffs plausibly plead a violation of the second clause. 7 Defendant argues Plaintiffs fails to do so because (1) Google does not intercept communications 8 while they are in transit, and (2) Google does not read the communications. 9 1. Communications in Transit 10 To allege a predicate act under the second clause, a plaintiff must allege the eavesdropping 11 occurred “while the [communication] is in transit.” Cal. Penal Code § 631(a). “‘While’ is the key 12 word here.” Valenzuela v. Keurig Green Mountain, Inc., 674 F. Supp. 3d 751, 758 (N.D. Cal. 13 2023). “[I]nterception under the meaning of the statute must occur during transmission of the 14 communication.” Hazel v. Prudential Fin., Inc., No. 22-cv-07465-CRB, 2023 WL 3933073, at *2 15 (N.D. Cal. June 9, 2023) (cleaned up) (collecting cases). So, “the crucial question under § 16 631(a)’s second clause is whether [Plaintiffs] ha[ve] plausibly alleged that [Google] read one of 17 [their] communications while it was still in transit, i.e., before it reached its intended recipient.” 18 Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1137 (E.D. Cal. 2021) (citing Mireskandari v. Mail, 19 12-cv-02943-MMM (FFMx), 2013 WL 1219559, at *10 n.44 (C.D. Cal. July 30, 2013)). 20 Here, Plaintiffs plausibly allege Google intercepted communications while they were in 21 transit to Defendant. Namely, Plaintiffs allege Defendant’s website uses the “Google Analytics 22 Javascript code” which, “while Plaintiffs and Class members were and are interacting with the 23 Psychology Today website, Google, concurrently and in real time, did and does intercept, read, 24 and analyze user communications and interpret the contents of those communications for Google 25 subsequently to use for its advertising and analytics purposes.” (Dkt. No. 55 ¶ 6.) Google 26 “markets the real-time reporting capabilities of Google Analytics and boasts that ‘Realtime 27 reports’ allow website hosts to ‘monitor activity on your website as it happens.’” (Id. ¶ 40.) And 1 site changes have on your traffic.” (Id.; see also id. ¶ 41 (alleging the code reads user inputs in 2 Defendant’s website “while those communications are in transit to the host website.”).) Further, 3 the code “interprets and selects, in real time, which portions of the communications Google will 4 use for further processing and analysis.” (Id. ¶ 42.) Unlike in previous iterations of the complaint, 5 Plaintiffs explain in detail how Google Analytics functions while communications are in transit:

6 The initial reading, interpretation, and selection by Google Analytics code occurs while the user communication is in transit to Psychology 7 Today and even before the user hits the “Show # Therapists” button. Importantly, the filter options chosen by the user and shared with 8 Google not only reflect that a particular button was clicked or box was checked, but also disclose to Google, in real-time, the actual content 9 of that button click – namely the users’ sensitive medical information. The intercepted information very clearly includes the user’s mental 10 health symptoms, concerns, and need for and type of treatment sought. See Figures 7-12, showing snapshots of Google Analytics 11 intercepting, reading, analyzing, and selecting a user’s interactions and communications with Psychology Today in realtime, and then 12 displaying within a few milliseconds the captured medical information in the Inspect Tool feature on a user’s browser. 13 (Id. ¶ 60.) The TAC further supports Plaintiffs’ allegations through a demonstrative video 14 showing how Google Analytics works. (Id. ¶ 63 n.10; Dkt. No. 56.)3 In the video, at the same 15 time the user clicks the “Anxiety” filter, the webpage updates the number of therapists for that 16 filter and the developer tools panel shows Google Analytics captures that same information. (Dkt. 17 No. 56 at 1:14-15.) The same is true when the user selects “Drug Abuse,” (id. at 2:16-17) and 18 LGBTQ+ (id. at 2:48-49). So, although previously Plaintiffs only alleged Google Analytics 19 viewed or read the code after it was sent to Defendant (Dkt. No. 51 at 13), Plaintiffs now allege 20 interception occurred “while the same is in transit.” See Licea v. Cinmar, LLC, 659 F. Supp. 3d 21 1096, 1110 (C.D. Cal. 2023). 22 Defendant dedicates most of its moving papers to a factual dispute about how Google 23 Analytics works, but this approach misunderstands what the Court must do under Rule 12(b)(6). 24 Defendant cites the proper standard but emphasizes the wrong words: 25

26 The standard governing this Court is well-settled: “To survive a 27 motion to dismiss, a complaint must contain sufficient factual 1 matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting 2 Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)) (emphasis added). 3 (Dkt. No. 62 at 4 (emphasis in original).) The key language here is “accepted as true.” Iqbal, 556 4 U.S. at 678. At the pleading stage, a court must “accept factual allegations in the complaint as true 5 and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. 6 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). And “[i]f the Court ‘goes 7 beyond the pleadings to resolve an issue,’ a [dismissal] is not appropriate and ‘such a proceeding 8 must properly be treated as a motion for summary judgment.’” Special Dist. Risk Mgmt. Auth. v. 9 Munich Reinsurance Am., Inc., 562 F. Supp. 3d 989, 993 (E.D. Cal. 2021) (quoting Hal Roach 10 Studios, Inc. v. Richard Feiner & Co., 896 F.2d 1542, 1550 (9th Cir. 1989)). So, the Court will 11 not go beyond the pleadings to resolve factual disputes that are not now ripe for adjudication. 12 Defendant’s reliance on other courts’ recitations of how Google Analytics works is 13 improper. For example, Defendant claims certain “facts” are undisputed and cites Brown v. 14 Google LLC, 685 F. Supp. 3d 909, 919 (N.D. Cal. 2023) (denying Google’s motion for summary 15 judgment), and Smith v. Google, LLC, 735 F. Supp. 3d 1188, 1193 (N.D. Cal. 2024) (denying 16 Google’s motion to dismiss) as support. But Defendant does not cite any law, and the Court is not 17 aware of any, that supports Defendant’s assertion that Plaintiffs are somehow bound by the 18 summary judgment record in a case to which it was not a party (Brown), or the complaint 19 allegations in another case to which it was not a party (Smith). For this reason, alone, Defendant’s 20 motion fails. The question here is whether Plaintiffs’ allegations, assumed as true, plausibly 21 satisfy the “in transit” requirement. 22 Defendant also requests, in a footnote, that the Court consider as incorporated by reference 23 “Google’s publicly available materials,” (Dkt. No. 57 at 17 n.2.) But none of the websites 24 Defendant identifies are cited in the TAC. (Compare Dkt. No. 55 at 26 n.11 with Dkt. No. 57 n.3.) 25 For example, Defendant asserts as an undisputed fact that “[w]hen the measurement code collects 26 data, it packages that information up and sends it to Google Analytics to be processed into 27 reports.” (Dkt. No. 57 at 19.) But the Google webpage it cites is not referred to in the Third 1 Amended Complaint. So, Defendant has not established incorporation by reference is appropriate. 2 And, even if the Court could consider the cited website material, the Court must draw all 3 reasonable inferences in Plaintiffs’ favor, and when doing so, the quoted language does not 4 foreclose an inference that Google’s “packaging” of the data occurs while the communication is in 5 transit. And nothing Defendant cites requires that the interception or collection occur after data 6 has been sent to Defendant. 7 Finally, on reply, Defendant argues Plaintiffs’ video attachment proves Google Analytics’ 8 collection of data is asynchronous with data input. In so doing, Defendant asks the Court to parse 9 the milliseconds between when data is sent to the site and when the page finally loads. (Dkt. No. 10 62 at 12-13.) On the face of the video, it is not undisputed that data reaches Defendant before it is 11 allegedly intercepted by Google. Instead, Defendant’s analysis of the video requires the Court 12 draw inferences in its favor rather than Plaintiffs’ favor; at this procedural posture, the Court may 13 not do so. 14 So, Plaintiffs plausibly plead Google’s interception occurs “while the [communication] is 15 in transit.” Cal. Penal Code § 631(a); see also, Hazel v. Prudential Fin., Inc., No. 22-cv-07465- 16 CRB, 2023 WL 3933073, at *4 (N.D. Cal. June 9, 2023) (“Whether that information was 17 intercepted by TrustedForm before it was stored by Prudential as Plaintiffs allege, or vice versa, is 18 a question for summary judgment.”). 19 2. “Reads” Communications 20 To be liable under the second prong of § 631, the third-party must “read[], or attempt[] to 21 read, or to learn the contents or meaning of any message, report, or communication” while the 22 same is “in transit.” Cal. Penal Code § 631. “Though section 631 does not define ‘read’ or 23 ‘attempt to read,’ courts generally conclude that liability under prong two of section 631 ‘requires 24 some effort at understanding the substantive meaning of the message, report or communication.’” 25 Torres v. Prudential Fin., Inc., No. 22-cv-07465-CRB, 2025 WL 1135088, at *5 (N.D. Cal. Apr. 26 17, 2025) (quoting Williams v. DDR Media, LLC, 757 F. Supp. 3d 989, 995 (N.D. Cal. 2024) 27 (analyzing the plain meaning of “read” based on dictionary definitions and prior case law)). 1 been stored, they also allege Google Analytics reads, interprets, and selects the data while it is in 2 transit. (Dkt. No. 55 ¶ 60.) Plaintiffs allege that as users input information into the website, 3 Google “interpret[s] and select[s] specified portions of the user’s interactions and communications 4 to be used for advertising and analytics, all while the transmissions are in transit to the Psychology 5 Today website servers.” (Id. ¶ 63; see also id. ¶ 41 (“the Google Analytics JavaScript code 6 intercepts, reads, and analyzes the substantive content of a user’s interactions and communications 7 while they are in transit to the host webpage. The JavaScript code then interprets and selects, in 8 real time, which portions of the communications Google will use for further processing and 9 analysis. The intercepted information is read by Google while the entire communication travels 10 from the user to the host website.”).) These allegations, drawing all reasonable inferences in 11 Plaintiffs’ favor, plausibly plead Google performs “some effort at understanding the substantive 12 meaning of the message.” Torres, 2025 WL 1135088, at *5 (cleaned up). 13 Defendants’ reliance on Torres v. Prudential does not persuade the Court to the contrary. 14 Id. There, the court, on the summary judgment record, concluded there was no genuine dispute 15 “[w]ebform inputs are collected and stored as a series of undeciphered ‘events,’ which are then 16 provided to host websites to interpret using the ActiveProspect server.” Id. Since no substantive 17 meaning was being deciphered at the time of interception, the software’s interception was not 18 “reading” the communications under § 631. Id. Here, by contrast, Plaintiffs allege Google— 19 while users are inputting information—“analyzes and interprets the contents of a user’s 20 transmissions in order to select what portion of the communications is further processed by 21 Google for its analytics and advertising purposes.” (Dkt. No. 55 ¶ 41.) This allegation plausibly 22 supports an inference this initial real time process of selection for advertising purposes is an 23 “effort at understanding the substantive meaning of the message, report or communication.” 24 Torres, 2025 WL 1135088, at *5 (cleaned up). 25 Defendants’ further citation to Williams is inapposite. There, also on summary judgment, 26 the court held “the data [the third-party software] receives is automatically subjected to an 27 algorithm that transforms the data into an incomprehensible ‘hash’ that has no inherent substantive 1 Supp. 3d at 995. Specifically, the software’s process there involved automatic alteration of data, 2 nearly instantaneously, which the court held “does not involve any attempt by [it] to understand 3 the substantive meaning of the data.” Id. By contrast, Plaintiffs here plausibly allege Google 4 Analytics analyzes communications as they are sent, filtering data to be used for advertising 5 purposes from that which will not. And the Court “must accept as true all of the allegations 6 contained in [the TAC].” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). When accepting these 7 allegations as true, the TAC pleads Google reads or attempts to read or understand the 8 communications while the same are in transit. 9 In its reply brief, Defendant for the first time argues Google Analytics cannot read 10 communications because it “does not have a brain of its own.” (Dkt. No. 62 at 10.) Because this 11 argument was raised for the first time on reply, the Court need not consider it. Even so, Defendant 12 does not cite any cases that have so held and indeed the Court is not aware of any case that 13 squarely considered the issue. Cf. Ambriz v. Google, LLC, No. 23-cv-05437-RFL, 2025 WL 14 830450, at *4 (N.D. Cal. Feb. 10, 2025) (rejecting argument that Google’s software does not learn 15 the contents of communication because, “[w]hen GCCCAI ‘learns’ the content of the call, that is 16 the same as Google ‘learning’ it.”). Instead, courts have regularly held use of software to 17 eavesdrop into communications is a basis for § 631 claims. See, e.g., D’Angelo v. FCA US, LLC, 18 726 F. Supp. 3d 1179, 1198-99 (S.D. Cal. 2024) (holding the complaint properly alleged a § 631 19 claim when it alleged the “[d]efendant allows Salesforce ‘to secretly intercept in real time’ chat 20 communications on the Website by ‘embedd[ing]’ code that ‘directs [chat] communications to be 21 routed directly to Salesforce.’”); Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. 22 Cal. 2023) (holding the plaintiff properly pled a § 631 claim where “ActiveProspect monitors, 23 analyzes, and stores information about visits to Assurance’s websites, and that Active Prospect can 24 use that information for other purposes, even if [the plaintiff] has not alleged that they have done 25 so in this case.”). 26 So, drawing inferences in Plaintiffs’ favor, the TAC plausibly pleads Google “reads, or 27 attempts to read, or to learn the contents or meaning of any message, report, or communication.” 1 CONCLUSION 2 Because Plaintiffs have plausibly pled Google “reads, or attempts to read, or to learn the 3 contents or meaning of any message, report, or communication” while the same is “in transit,” 4 || Defendant’s motion to dismiss Plaintiffs’ California Penal Code § 631 claim is DENIED. 5 This Order disposes of Docket No. 57. 6 IT IS SO ORDERED. 7 || Dated: June 23, 2025 8 9 ne

CQVUELINE SCOTT CORLEY

10 United States District Judge 11 a 12

2B

15

16

17

Z 18

19 20 21 22 23 24 25 26 27 28