1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 LORETTA WILLIAMS, Case No. 22-cv-03789-SI

8 Plaintiff,

ORDER GRANTING MOTIONS TO

9 v. DISMISS

10 DDR MEDIA, LLC, et al., Re: Dkt. Nos. 47, 48 11 Defendants.

12 13 Before the Court are defendants’ motions to dismiss. Dkt. Nos. 47, 48. For the reasons set 14 forth below, the motions to dismiss are GRANTED. 15 16 BACKGROUND1 17 Defendant Lead Intelligence, Inc. d/b/a Jornaya (“Jornaya”) provides a software known as 18 “TCPA Guardian,” which websites use to document users’ consent to receive telemarketing calls. 19 Dkt. No 43 at ¶ 5. One of the main features of TCPA Guardian is a “visual playback” function, 20 which records in real time users’ keystrokes and clicks interacting with Jornaya’s client websites. 21 Id. ¶¶ 2, 6. The TCPA Guardian records are “hosted on Jornaya’s servers,” and to access them one 22 must follow a hyperlink provided by Jornaya. Id. ¶ 25. Jornaya also independently collects and 23 stores website users’ information. Id. Defendant DDR Media, LLC d/b/a Royal Marketing Group 24 (“DDR Media”) owns a website called scrappyrent2own.com. Id. ¶ 9. TCPA Guardian is installed 25 on that website. Id. 26 1 Factual allegations are taken from the Amended Complaint and are assumed true for the 27 purposes of a Motion to Dismiss. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1 On or around December 10, 2021, Loretta Williams visited DDR Media’s website. Id. ¶ 20. 2 During her visit, her entire interaction with the website was recorded in real time by DDR Media 3 and Jornaya via TCPA Guardian. Id. ¶ 23. This recording captured information including the 4 plaintiff’s IP address, geographic location, name, address, and phone number. Id. ¶ 21, 22. DDR 5 Media did not inform plaintiff of such recording or seek prior consent. Id. ¶ 24. 6 On June 27, 2022, plaintiff Loretta Williams filed a complaint, on behalf of herself and those 7 similarly situated, against defendants DDR Media and Jornaya. Dkt. No. 1. Claiming jurisdiction 8 under CAFA, 28 U.S.C. § 1332(d), et seq., plaintiff brings causes of action pursuant to (1) the 9 California Invasion of Privacy Act (“CIPA”), California Penal Code Section 631(a) (“Section 10 631(a)”), (2) California’s Unfair Competition Law Cal. Bus Prof. Code Section 17200, et seq. 11 (“UCL”), and (3) the California Constitution. Id. On December 15, 2022, defendants filed a joint 12 motion to compel arbitration, Dkt. No. 29, which the Court denied. Dkt. No. 36. Plaintiff filed an 13 amended complaint. Dkt. No. 43. 14 On April 12, 2023, DDR Media filed a motion to dismiss for failure to state a claim, lack of 15 subject matter jurisdiction, and lack of Article III standing. Dkt. No. 47. On April 13, 2023, Jornaya 16 also filed a motion to dismiss for failure to state a claim. Dkt. No. 48. Plaintiff opposes. Dkt. No. 17 50. The Court heard the motions on June 16, 2023, at 10:00 AM. 18 19 LEGAL STANDARD 20 Federal Rule of Civil Procedure 12(b)(1) allows a party to challenge a federal court’s 21 jurisdiction over the subject matter of the complaint. As the party invoking the jurisdiction of the 22 federal court, the plaintiff bears the burden of establishing that the court has the requisite subject 23 matter jurisdiction to grant the relief requested. See Kokkonen v. Guardian Life Ins. Co. of America, 24 511 U.S. 375, 377 (1994) (internal citations omitted). A complaint will be dismissed if, looking at 25 the complaint as a whole, it appears to lack federal jurisdiction either “facially” or “factually.” 26 Thornhill Publ’g Co., Inc. v. General Tel. & Elecs. Corp., 594 F.2d 730, 733 (9th Cir. 1979); Safe 27 Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). When the complaint is challenged 1 taken as true and construed in the light most favorable to the plaintiff. NL Indus. v. Kaplan, 792 2 F.2d 896, 898 (9th Cir. 1986). 3 Under Federal Rule of Civil Procedure 12(b)(6), a district court must dismiss a complaint if 4 it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion to 5 dismiss, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” 6 Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This “facial plausibility” standard requires 7 the plaintiff to allege facts that add up to “more than a sheer possibility that a defendant has acted 8 unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While courts do not require “heightened 9 fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a right to relief above the 10 speculative level.” Twombly, 550 U.S. at 555, 570. 11 In deciding whether the plaintiff has stated a claim upon which relief can be granted, the 12 court must assume that the plaintiff’s allegations are true and must draw all reasonable inferences 13 in the plaintiff’s favor. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). 14 However, the court is not required to accept as true “allegations that are merely conclusory, 15 unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 16 1049, 1055 (9th Cir. 2008). 17 If the Court dismisses the complaint, it must then decide whether to grant leave to amend. 18 The Ninth Circuit has “repeatedly held that a district court should grant leave to amend even if no 19 request to amend the pleading was made, unless it determines that the pleading could not possibly 20 be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) 21 (citations and internal quotation marks omitted). 22 23 DISCUSSION 24 I. Unfair Competition Law 25 In their motions to dismiss, defendants argue that plaintiff failed to state a claim under 26 California’s UCL because plaintiff did not allege an injury in fact that involves loss of money or 27 property. Dkt. No. 47 at 11; Dkt. No. 48 at 9. Plaintiff concedes that she does not have standing 1 see Birdsong v. Apple, Inc., 590 F .3d 955, 959 (9th Cir. 2009) (holding that standing under the UCL 2 requires the plaintiff to allege injury in fact and loss of money or property). Therefore, defendants’ 3 motion to dismiss plaintiff’s UCL claim for failure to state a claim is granted without leave to 4 amend.2 5 6 II. California Penal Code Section 631(a) 7 Section 631(a) of the California Penal Code penalizes: 8 Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether 9 physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or 10 instrument of any internal telephonic communication system, or 11 who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning 12 of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this 13 state; or 14 who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, 15 or who aids, agrees with, employs, or conspires with any person or persons to 16 unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section[.] 17 Cal. Penal Code § 631(a) (line breaks added). 18 Plaintiff argues that Jornaya violated the second prong of Section 631(a) and DDR Media 19 violated the fourth prong. Specifically, plaintiff alleges that (1) Jornaya’s TCPA Guardian was a 20 “new technology” that falls within the definition of “a machine, instrument, contrivance, or … any 21 other manner” and (2) by using it, Jornaya intentionally read or learned the contents of a message, 22 report, or communication (3) “without prior express consent.” Dkt. No. 43 ¶¶ 39–42; see Matera v. 23 Google Inc., 2016 WL 8200619, at *21 (N.D. Cal. Aug. 12, 2016) (applying Section 631(a) to new 24 technology such as email). DDR Media was a party in the communication that cannot be sued under 25 the first three prongs, but plaintiff alleges that DDR Media is liable for violating the fourth prong 26

27 2 DDR Media also argues that plaintiff failed to allege a violation of an underlying law 1 because it partnered with Jornaya. Id. ¶43. 2 Both defendants argue that this claim should be dismissed because (1) Jornaya merely 3 enabled DDR Media to record its own communications and did not act as a third-party eavesdropper; 4 and (2) the information allegedly intercepted was “record information” not protected by the statute. 5 Dkt. No. 47 at 4–8; Dkt. No. 48 at 4–5, 8. In addition, DDR Media argues that plaintiff fails to 6 plead facts showing that the information was intercepted “in transit” and that the alleged intrusion 7 did not involve a wiretap of a “telegraph or telephone wire, line, cable, or instrument.” Dkt. No. 48 8 at 6–7. 9 Defendants argue that Jornaya was not a third-party eavesdropper because its software 10 “acted as an extension of” DDR Media’s website rather than intercepting and using the data for 11 Jornaya’s own purposes. See Dkt. No. 47 at 5. 12 Section 631 does not prohibit parties from recording their own conversations, even without 13 the other party’s knowledge. See Rogers v. Ulrich, 52 Cal. App. 3d 894, 899, 125 Cal. Rptr. 306 14 (Ct. App. 1975) (“[O]nly a third party can listen secretly to a private conversation.”). In Rogers v. 15 Ulrich, a California appellate court rejected Section 631 claims against a defendant who had 16 recorded his own conversations and then played the recordings to others. Id. However, if one 17 participant in a conversation permits a third party to eavesdrop on a conversation without the 18 knowledge of the other participant, then the third party is liable under the second prong of Section 19 631 (and the participant may be liable under the fourth prong). Ribas v. Clark, 38 Cal. 3d 355, 361, 20 696 P.2d 637, 641 (1985). In Ribas v. Clark, a woman in the middle of divorce proceedings asked 21 a friend to listen in on a phone call to the woman’s husband. Id. at 358, 696 P.2d 637. The California 22 Supreme Court held that this act constituted eavesdropping under the statute because “a substantial 23 distinction has been recognized between the secondhand repetition of the contents of a conversation 24 and its simultaneous dissemination to an unannounced second auditor.” Id. at 360, 696 P.2d 640. 25 Defendants argue that Jornaya merely provided DDR Media with “a tool . . . like a tape 26 recorder.” Dkt. No. 47 at 5. Plaintiff argues that defendants’ reasoning would add an additional 27 “use” requirement into the second prong of Section 631(a) and that Jornaya is liable for recording 1 Jornaya’s TCPA Guardian software is more akin to a tape recorder or a secret listener. 2 This is a close question, and district courts have split on the issue. In Graham v. Noom, Inc., 3 a district court considered similar allegations against Fullstory, a company that provides software 4 that “records visitor data such as keystrokes, mouse clicks, and page scrolling” and enables clients 5 to “see a ‘playback’ of any visitor’s session.” Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. 6 Cal. 2021). The court held that Fullstory was not a third-party eavesdropper because it captured 7 data only for the client website to use. The court reasoned that Fullstory “provides a tool – like the 8 tape recorder in Rogers – that allows [a client website] to record and analyze its own data in aid of 9 [the client website’s] business.” Id. at 832. Because there were no allegations that Fullstory 10 “intercepted and used the data itself,” the court concluded that it was not a third-party eavesdropper. 11 Id. at 833. Other courts have followed Graham’s reasoning. See, e.g., Williams v. What If Holdings, 12 LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *3 (N.D. Cal. Dec. 22, 2022) (concluding that 13 software vendor “functioned as a recorder, and not as an eavesdropper”); Johnson v. Blue Nile, Inc., 14 No. 20-CV-08183-LB, 2021 WL 1312771, at *2 (N.D. Cal. Apr. 8, 2021). 15 In Javier v. Assurance IQ, LLC, a district court took issue with this reasoning. Javier v. 16 Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 114225, at *6 (N.D. Cal. Jan. 5, 2023). It 17 found that considering a software vendor’s use of the information to determine whether it was a 18 third-party eavesdropper “read[s] a use requirement into the second prong” of Section 631(a). 19 Because the third prong of Section 631(a) separately penalizes use of information obtained via 20 wiretapping, the court reasoned that considering use in analyzing the second prong would “add 21 requirements that are not present (and swallow the third prong in the process).” Id. It also noted 22 that the California Supreme Court did not consider the third party eavesdropper’s “intentions” or 23 “the use to which they put the information they obtained” in Ribas v. Clark, 38 Cal. 3d 355, 696 24 P.2d 637 (1985). The Javier court concluded that so long as the recording software provider has 25 “the capability to use its record of the interaction for any other purpose,” it is a third-party 26 eavesdropper. Id. 27 This is a difficult issue, and the Javier court’s point that use is penalized by the third prong 1 penalizes anyone who “reads, or attempts to read, or to learn the contents or meaning of” the 2 communication. Cal. Penal Code § 631(a). A person who eavesdrops on a conversation clearly 3 falls under that definition. And a software company that analyzes or uses a recorded communication 4 has read, attempted to read, or learned the contents of that communication. But the Court can think 5 of no sense in which Jornaya has read, attempted to read, or learned the contents or meaning of the 6 communication at issue here. Jornaya has merely recorded the communication for retrieval by a 7 party to the same communication. Thus, the Court finds that Jornaya is more akin to a tape recorder 8 vendor than an eavesdropper. 9 Because plaintiff has not sufficiently alleged that a third-party read, attempted to read, or 10 learned (or attempted to learn) the contents or meaning of its communication, her claim under 11 Section 631(a) is dismissed.3 12 13 III. Invasion of Privacy Under the California Constitution 14 In their motions to dismiss, defendants argue plaintiff failed to state a claim for invasion of 15 privacy under the California Constitution. To state a claim of invasion of privacy under the 16 California Constitution, plaintiff must show (1) she possesses a legally protected privacy interest, 17 (2) she maintains a reasonable expectation of privacy, and (3) the defendant’s conduct amounts to a 18 serious invasion of privacy. Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009). To state a 19 claim for of invasion of privacy under California common law, the plaintiff must show the defendant 20 “intentionally intruded into a place… in which the plaintiff has a reasonable expectation of privacy,” 21 and “the intrusion occurred in a manner highly offensive to a reasonable person.” Id. Because of 22 the similarity in these tests, courts often simplify the elements required for an invasion of privacy 23 claim to two factors: “(1) there exists a reasonable expectation of privacy, and (2) the intrusion was 24 highly offensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). 25 Defendants argue the invasion of privacy claim failed because it did not show a “highly 26 offensive intrusion” as required by the California Constitution Article 1, Section 1. Dkt. No. 47 at 27 1 8; Dkt. No. 48 at 9. Plaintiff argues that she plausibly alleged a reasonable expectation of privacy 2 and the issue of whether the alleged invasion of privacy was highly offensive cannot be resolved at 3 the pleadings stage. Dkt. No. 50 at 13. 4 Plaintiff primarily relies on In Re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 5 601 (9th Cir. 2020), for the proposition that the question of whether the alleged invasion of privacy 6 was highly offensive cannot be resolved at the pleadings stage. Dkt. No. 50 at 13. In Facebook 7 Internet Tracking, the Ninth Circuit considered allegations that Facebook was tracking user activity 8 across the internet even after users had logged out of the website. 956 F.3d at 606. The court held 9 the issue of whether Facebook’s tracking and collection practices were highly offensive was an issue 10 that “cannot be resolved at the pleading stage.” Id.; see also, Hart v. TWC Prod. & Tech. LLC, 526 11 F. Supp. 3d 592, 602 (N.D. Cal. 2021) (holding the issue of whether tracking user activity through 12 the weather app even after it was closed is highly offensive cannot be resolved at the pleading stage). 13 But the conclusion in Facebook Internet Tracking made a case-specific determination, not a 14 generalized holding that this issue can never be resolved at the pleadings stage. The Ninth Circuit 15 reasoned: 16 The ultimate question of whether Facebook's tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the 17 pleading stage. Plaintiffs have identified sufficient facts to survive a motion to dismiss. Plaintiffs’ allegations of surreptitious data collection when individuals were 18 not using Facebook are sufficient to survive a dismissal motion on the issue. Indeed, Plaintiffs have alleged that internal Facebook communications reveal that the 19 company's own officials recognized these practices as a problematic privacy issue. 20 956 F.3d at 606. The Ninth Circuit explicitly distinguished Facebook Internet Tracking from cases 21 where district courts found no highly offensive intrusion. Id. at 606 n.8. If the Ninth Circuit 22 intended to invalidate those cases rather than distinguish them, it would have done so. Facebook 23 Internet Tracking does not stand for the proposition that this question cannot be resolved at the 24 pleadings stage. 25 The Court turns to the question of whether plaintiff plausibly alleged a highly offensive 26 intrusion in this case. The California Constitution sets a high standard for intrusion. The analysis 27 of intrusion involves the “degree to which the intrusion is unacceptable as a matter of public policy.” 1 Facebook Internet Tracking, 956 F.3d at 606. Factors such as “the likelihood of serious harm to the 2 victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether 3 countervailing interests or social norms render the intrusion inoffensive” may also be considered. 4 Id. The intrusion must constitute an “egregious breach of social norms.” Hernandez, 47 Cal 4th at 5 295 (citing Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 8, 37 (1994)). 6 The plaintiff in this case alleges limited information was recorded without consent during a 7 single visit to the website; unlike the plaintiffs in Facebook Internet Tracking, she does not allege 8 defendants tracked her activity after she left the website. Compare Dkt. No. 43 ⁋⁋ 21–22 with 956 9 F.3d at 596. When determining whether an intrusion is highly offensive, other courts in the district 10 have considered whether the information was gathered after users left the defendants’ websites. See 11 Facebook Internet Tracking, 956 F.3d at 606 n.8 (distinguishing cases where there were “no 12 allegations that the defendants tracked the plaintiffs after the plaintiffs stopped using the defendant's 13 services”); Hart v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 602 (N.D. Cal. 2021) (finding 14 plaintiff plausibly alleged highly offensive intrusion where defendant “allegedly tracked, stored, and 15 shared precise location data on a continuous basis, even when the user did not have the app open”). 16 The information allegedly gathered in this case is minimal. Plaintiff alleges defendants 17 recorded the date and time of plaintiff’s visit to DDR Media’s website, her keystrokes and clicks on 18 the website, her name, her IP address, her geographic location, her address, and her phone number. 19 Dkt. No. 43 ⁋⁋ 21–22. In contrast, in Facebook Internet Tracking, the plaintiffs alleged Facebook 20 captured extensive information about plaintiffs’ internet activity and turned it into detailed “personal 21 profiles” that described the plaintiffs. 956 F.3d at 596. The alleged data gathering in this case is 22 much less extensive than in other cases where a highly offensive intrusion was sufficiently alleged. 23 See, e.g., In re Google RTB Consumer Priv. Litig., 606 F. Supp. 3d 935, 947 (N.D. Cal. 2022) 24 (denying motion to dismiss where plaintiffs alleged “Google sells sensitive personal information 25 such as plaintiff's IP address, geo-location data, and web-browsing information, search terms, and 26 sensitive websites that plaintiffs visited relating to race, religion, sexual orientation, and health”); 27 In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 830 (N.D. Cal. 2020) (finding it is a “close 1 call” whether intrusion was highly offensive where Google Assistant recorded conversations after 2 falsely identifying words meant to trigger recording). 3 Indeed, the information gathered here is less extensive than that gathered in other cases 4 where no highly offensive intrusion was found. See, e.g., Hammerling v. Google LLC, No. 21-CV- 5 09004-CRB, 2022 WL 17365255, at *9 (N.D. Cal. Dec. 1, 2022) (finding no highly offensive 6 intrusion where Google allegedly collected information including a plaintiff’s bank, the car she 7 drove, another plaintiff’s religious beliefs, and shopping searches); In re Google, Inc. Privacy Pol’y 8 Litig., 58 F. Supp. 3d 968, 988 (N.D. Cal. 2014) (finding no intrusion where Google commingled 9 data collection across its platforms). 10 There is also a distinction in the defendants’ use of the recorded information. Here, the 11 information was being sent back to the same website the plaintiff willingly provided her information 12 to, while in Facebook Tracking Litigation and other cases where a highly offensive intrusion was 13 adequately alleged, the plaintiffs’ information was sold to third parties for advertising and marketing 14 purposes. See, e.g., Facebook Tracking Litigation, 956 F.3d at 600; In re Google RTB Consumer 15 Priv. Litig., 606 F. Supp. 3d 935, 947 (N.D. Cal. 2022). Plaintiff voluntarily provided information 16 to DDR Media; to the extent that information was provided to a third party, plaintiff alleges no use 17 by the third party other than storing that information for DDR Media to refer back to. Defendants’ 18 use of the information here was benign. See Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 19 986, 991 (2011) (finding the intrusion when the defendant wrongfully obtained the plaintiff’s 20 address through misrepresentation and used it to send him unsolicited advertisements was not highly 21 offensive but was rather “routine commercial behavior”). 22 Plaintiff has alleged a minimal intrusion that was not highly offensive. Accordingly, 23 defendants’ motion to dismiss the claim of invasion of privacy under the California Constitution is 24 granted with leave to amend. 25 26 CONCLUSION 27 For the foregoing reasons and for good cause shown, the Court hereby GRANTS 1 amend is granted as to plaintiff's other claims. If plaintiff wishes to amend her claims, she must 2 || doso no later than September 20, 2023, or her claims will be dismissed with prejudice. 3 4 IT IS SO ORDERED. 5 Dated: August 18, 2023 6 Af | sf f pa □□

SUSAN ILLSTON

7 United States District Judge 8 9 10 11 12

© 15 16 & = 17

Z 18

19 20 21 22 23 24 25 26 27 28