1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 MICHAEL KATZ-LACABE, et al., 10 Case No. 22-cv-04792-RS Plaintiffs, 11 v. ORDER GRANTING MOTION TO 12 DISMISS AND GRANTING SEALING

ORACLE AMERICA, INC., MOTIONS

13 Defendant. 14

15 I. INTRODUCTION 16 In this putative data privacy class action, Plaintiffs aver Defendant Oracle America, Inc.’s 17 collection and use of internet users’ personal data violates their right to privacy as enshrined in the 18 California Constitution and various state and federal privacy statutes. Oracle now moves to 19 dismiss two causes of action in the Second Amended Class Action Complaint (“SAC”): (1) the 20 Electronic Communications Privacy Act (“ECPA”) (Federal Wiretap Act) claim and (2) the 21 intrusion upon seclusion claim premised on Florida common law. Both parties have also filed 22 administrative motions to seal portions of their sur-reply briefs. For the reasons that follow, 23 Oracle’s motion to dismiss is granted. The parties’ sealing motions are also granted. 24 II. BACKGROUND1 25 Plaintiffs are two named individuals—Michael Katz-Lacabe and Dr. Jennifer Golbeck— 26 1 The factual background of this case is based on the well-pled allegations in the SAC, which are 27 taken as true for the purposes of this motion. This background is presented in greater detail in 1 who purport to represent five separate classes of individuals. Despite taking precautions to 2 maintain privacy and prevent third-party collection of their data, Plaintiffs each received a 3 document from Oracle (an “OARRR”) indicating it had tracked, compiled, and analyzed their web 4 browsing and other activity, thereby creating an “electronic profile” of them. See Dkt. 54, at 2, 6. 5 Plaintiffs aver Oracle tracks their internet activity across numerous websites with various 6 technological tools, their location through partnership with the company PlaceIQ, and their 7 financial data, and then makes that information available to third parties without Plaintiffs’ 8 consent. 9 In the order resolving Oracle’s previous motion to dismiss (the “10/3 Order”), Plaintiffs’ 10 causes of action for (1) intrusion upon seclusion claim under Florida common law and 11 (2) violation of the ECPA were dismissed with leave to amend. The intrusion upon seclusion 12 claim was dismissed on the grounds Plaintiffs failed to show any particular “electronic space” 13 where Plaintiff Golbeck had a reasonable expectation of privacy and into which Oracle intruded. 14 The ECPA claim was dismissed because Plaintiffs failed to show Oracle had the requisite tortious 15 motivation to invoke the crime-tort “exception to the exception” in the statute. On November 17, 16 2023, Plaintiffs filed the SAC, which purports to amend the deficiencies identified in the 10/3 17 Order for each cause of action. Oracle again moves to dismiss both. The parties have also filed 18 administrative motions to seal portions of their respective sur-reply briefs, which were filed to 19 address a dispute that arose after Oracle filed its reply brief. 20 III. MOTION TO DISMISS 21 A. Legal Standard 22 A complaint must contain “a short and plain statement of the claim showing that the 23 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations” are not 24 required, a complaint must have sufficient factual allegations to state a claim that is “plausible on 25 its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 26 544, 555, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that 27 allows the court to draw the reasonable inference that the defendant is liable for the misconduct 1 alleged.” Id. (citing Twombly, 550 U.S. at 556). This standard asks for “more than a sheer 2 possibility that a defendant has acted unlawfully.” Id. The determination is a context-specific task 3 requiring the court “to draw on its judicial experience and common sense.” Id. at 679. 4 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the claims alleged in the 5 complaint. Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal 6 theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” See 7 Conservation Force v. Salazar, 646 F.3d 1240, 1242 (9th Cir. 2011) (internal quotation marks and 8 citation omitted). When evaluating such a motion, the court must accept all allegations of material 9 fact in the complaint as true and construe them in the light most favorable to the non-moving 10 party. In re Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). It must also “draw 11 all reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d 12 556, 561 (9th Cir. 1987). 13 B. DISCUSSION 14 1. ECPA Claim (Federal Wiretap Act) 15 a. New factual averments in the SAC 16 Plaintiffs, once again, invoke the “exception to the exception” in 18 U.S.C. § 2511(2)(d) in 17 opposing dismissal of their ECPA cause of action. Under the statute, interception of a 18 communication may be lawful “where one of the parties to the communication has given prior 19 consent to such interception.” 18 U.S.C. § 2511(2)(d). This exception, however, ceases to apply 20 where any “communication is intercepted for the purpose of committing any criminal or tortious 21 act.” Id. Plaintiffs’ ECPA claim has now been dismissed twice on the grounds the third-party 22 websites that deployed Oracle’s tools consented to the interceptions at issue and Plaintiffs have 23 not pled sufficient facts to invoke the crime-tort exception to this rule. Plaintiffs contend the SAC 24 now sufficiently pleads the crime-tort exception. Specifically, Plaintiffs make six new “sets” of 25 allegations revolving around: (1) statements made by Oracle’s former CEO, (2) a statement by an 26 Oracle senior executive, (3) Oracle’s internal statements about alcohol-related profiling, (4) a 27 former Oracle employee’s statement about user privacy tools, (5) Oracle’s criticism of Google’s 1 privacy-invasive practices, and (6) Oracle’s collection of data enabling political profiling and 2 targeting. See Dkt. 90, at 8. These averments were added to the SAC to demonstrate Oracle had 3 tortious intent underlying its data collection practices. They do not do so. 4 To start, none of the statements Plaintiffs attribute to Larry Ellison (Oracle’s former CEO), 5 a senior executive, or Oracle in the past help plead tortious intent. Plaintiffs first point to 6 statements Ellison made in 2001 about the need for a “national ID system” and about the nature of 7 privacy. Id. at 9. These decades-old statements do not show Oracle acted with tortious intent for 8 purposes of the ECPA claim. Accepting that “Oracle’s goal [was] tracking and compiling the 9 online and offline activity” of internet users, id., this goal does not demonstrate tortious 10 motivation. Plaintiffs further claim Oracle knew its data collection was “invasive and illegal” 11 because an Oracle executive wrote a blog post in 2021 that it was “ridiculous” for Google to claim 12 it was a party to communications it intercepted online. Id. at 9–11. This executive’s opinion as to 13 whether a data-collecting entity like Oracle or Google is a party to communications demonstrates 14 neither that the executive thought the legality of the data collection depended on whether Oracle 15 was a party nor that Oracle acted with a tortious purpose. Finally, Plaintiffs do not explain how 16 Oracle’s alleged “alcohol-based targeting” demonstrates tortious intent. See id. at 11. Plaintiffs 17 point to no evidence that the sale of alcohol-related segments is unlawful and do not show Oracle 18 had tortious intent in collecting or selling such data.2 19 Plaintiffs newly aver that a former Oracle employee, posting anonymously on an internet 20 message board, referred to an Oracle privacy tool3 as “purposefully never updated and knowingly 21 inaccurate.” Id. at 11–12.4 Plaintiffs offer this statement as evidence Oracle employees were aware 22

23 2 The SAC refers to a single anonymous source quoted in a 2019 news article as expressing reservations about alcohol-based targeting. 24 3 Plaintiffs refer to the tool as a “data opt-out tool.” Dkt. 90, at 11. 25 4 Oracle requests that the entire comment thread in which this anonymous post occurs (Exhibit B), 26 as well as two other documents to which Plaintiffs cite in the SAC (Exhibits A & C) be incorporated by reference into the SAC. See Dkts. 88-1, 92-1. Plaintiffs object to incorporation of 27 Exhibit B on the grounds Oracle’s request amounts to an improper attempt to generate a factual dispute at the motion to dismiss stage. The doctrine of incorporation by reference is meant to 1 “the company’s privacy practices were problematic” but that Oracle prevented users from taking 2 privacy-protective actions. Id. at 12. Even construing this allegation in the light most favorable to 3 Plaintiffs (assuming that the anonymous poster was in fact a former Oracle employee and that 4 Oracle built a privacy tool it knew was imperfect), it fails to show tortious intent. At most, it 5 supports the unremarkable proposition that an Oracle employee thought the company could be 6 investing more resources into protecting users’ privacy. Plaintiffs also point to Oracle’s 2019 7 criticism of Google in a document submitted “in the context of proposals of changes to Australian 8 privacy laws” to show Oracle “must know its own conduct tortiously intrudes on people’s 9 privacy.” Id. at 12, 13 (emphasis in original). The First Amended Complaint made a similar 10 reference to Google’s conduct. As before, an allegation that another company’s data collection 11 practices were insufficiently privacy-protective in the context of another nation’s privacy laws 12 does not tend to show Oracle had tortious intent in this case. 13 Finally, Plaintiffs aver Oracle misrepresented how it uses the data it collects to the public 14 (and to the Court) and that these misrepresentations evince tortious intent. Specifically, they claim 15 Oracle offered “sensitive interest segments,” including segments based on political orientation, for 16 sale as late as May 2021 and still creates political profiles of internet users while maintaining they 17 did neither to the public. Id. at 14. Oracle argues that even if Plaintiffs’ allegations that it has 18 misrepresented, or is currently misrepresenting, the extent to which it gathers political data and 19 sells it in its public-facing communications are taken as true, such misrepresentation(s) would not 20 demonstrate tortious intent given Plaintiffs’ recognition Oracle collected data pursuant to its profit 21 incentive. 22 Plaintiffs’ claims relating to alleged misrepresentations are, once again, insufficient to 23

24 prevent plaintiffs “from selecting only portions of documents that support their claims.” Khoja v. 25 Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Plaintiffs have not objected to incorporation by reference of Exhibits A or C. Incorporation by reference of all three documents is 26 appropriate under Khoja, and Oracle’s request for incorporation by reference of all three documents is granted. That said, the message board post to which Plaintiffs point does not tend to 27 show tortious intent even when considered in isolation. 1 invoke the crime-tort exception. Plaintiffs fail plausibly to allege Oracle’s underlying motivation 2 in collecting and selling data about internet users was anything other than to generate revenue. 3 See, e.g., In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 519 (S.D.N.Y. 2001); In re 4 Google Inc. Gmail Litig., No. 13-md-2430, 2014 WL 1102660, at *18 n.13 (N.D. Cal. Mar. 18, 5 2014). Plaintiffs acknowledge the “language of Oracle’s disclosures has evolved over the last four 6 years.” Dkt. 99, at 4. Though Plaintiffs aver Oracle sought to hide its data collection and sales 7 efforts because it knew they were “privacy-invasive and harmful,” Dkt. 90, at 16, they do not 8 plausibly allege Oracle thought any such efforts were tortious or point to any authority for the 9 proposition such collection or sales was unlawful. Indeed, the central facts Plaintiffs allege in 10 support of a misrepresentation theory establish only that Oracle had a privacy policy in August 11 2022 that was at odds with its data collection practices as late as May 2021. See SAC ¶¶ 128, 130. 12 All told, accepting all of Plaintiffs’ material factual allegations as true and construing them in the 13 light most favorable to them, Plaintiffs’ arguments that Oracle misrepresented its privacy practices 14 to consumers do not show it collected or sold data with tortious intent. 15 b. Consent 16 The federal Wiretap Act is a one-party consent statute. See 18 U.S.C. § 2511(2)(d). As was 17 true at earlier motions to dismiss in this case, Oracle’s customers chose to deploy Oracle’s tools on 18 their websites, and it necessarily follows that “one of the parties to the communication”—the 19 websites themselves—gave “prior consent to such interception.” Id. Plaintiffs now argue that 20 because Oracle attempted to mislead the public as to its “privacy-invasive conduct,” it has “failed 21 to demonstrate the websites consented to Oracle’s interceptions.” Dkt. 90, at 16–18. They attempt 22 to distinguish this case from Rodriguez v. Google, LLC, No. 20-cv-4688, 2021 WL 2026726 (N.D. 23 Cal. May 21, 2021), which refused to adopt a “consent-upon-consent” framework dependent on a 24 user’s privacy expectations, by claiming third-party websites “do not understand or consent to the 25 scope of Oracle’s further uses of the communications it intercepted.” Dkt. 90, at 17. 26 Oracle’s basis for invoking the one-party consent exception to the federal Wiretap Act is as 27 clear in this motion as it has been previously. Indeed, in its opposition to Oracle’s previous motion 1 to dismiss, Plaintiffs did not contest the exception’s applicability. Third-party websites agreed to 2 deploy Oracle’s data collection tool, and Plaintiffs offer no plausible reason to conclude their 3 consent was conditioned on Oracle limiting the types of data it collected or how it then used that 4 data. Plaintiffs’ argument is similar to the theory rejected in Rodriguez that websites do not 5 actually consent to Oracle’s data interception where interception may theoretically conflict with 6 “individual privacy expectations.” Rodriguez, 2021 WL 2026726, at *5. To the contrary, the 7 Oracle-generated technical guide repeatedly cited in the SAC explains to Oracle’s customers how 8 Oracle’s data collection tool works and how, for instance, customers can “organize the online user 9 attributes” they ingest.5 See Dkt. 92, at 14. Oracle’s customers seem to have had clear instruction 10 regarding what data Oracle’s tools would collect and even how they could modify the operation of 11 those tools. Plaintiffs’ new arguments fail to make a plausible showing the third-party websites did 12 not consent to Oracle’s data interceptions. 13 c. Arguments raised in sur-reply 14 In their sur-reply, Plaintiffs accuse Oracle of withholding discovery and misrepresenting 15 whether it creates sensitive interest segments based on customer data regarding, for example, 16 users’ political orientations. Plaintiffs argue Oracle produced additional discovery after filing its 17 reply brief, that this additional production demonstrates Oracle created sensitive interest segments 18 during the course of this litigation despite disavowing doing so, that this conduct “harms class 19 members,” and that Oracle’s prior nondisclosure of this conduct shows tortious intent. Id. at 1, 4– 20 6. Plaintiffs argue they should be granted leave to amend the SAC to include this new material 21 should their ECPA cause of action be dismissed. The question, at this stage, is whether the late 22 disclosure of this data warrants granting leave to amend yet again. For the following reasons, it 23 does not. 24

25 5 See Oracle Data Cloud Core Tag Implementation, Oracle, https://perma.cc/8XVU-8Z2F. 26 Though it appears neither party sought incorporation by reference of this document, sua sponte incorporation by reference is appropriate given that it is repeatedly cited in the SAC. See, e.g., In 27 re Tesla, Inc. Sec. Litig., 477 F. Supp. 3d 903, 934 n.12 (N.D. Cal. 2020). 1 First, the timing of Oracle’s disclosure would not help Plaintiffs show the underlying 2 interceptions were made with the tortious intent necessary for the crime-tort exception to apply. 3 Oracle represents it generated the discovery material in response to Plaintiffs’ discovery requests, 4 “does not generate or use such records in the ordinary course of business,” and “expend[ed] 5 considerable resources to create” it. Dkt. 101, at 1 (emphasis omitted). Plaintiffs do not make a 6 plausible showing that the timing of Oracle’s production demonstrates tortious intent. 7 Second, Plaintiffs claim the substance of Oracle’s discovery production shows Oracle has 8 misrepresented its data collection policies to the public and to the Court and does, in fact, create 9 and sell sensitive interest segments. This allegation mirrors similar claims Plaintiffs make 10 throughout the SAC and their opposition to Oracle’s motion to dismiss. Plaintiffs have repeatedly 11 alleged, for example, that Oracle’s data collection is “invasive,” see, e.g., Dkt. 99, at 1, but this 12 claim is insufficient plausibly to allege Oracle had tortious motivation in collecting data. The fact 13 data collection or sales might at some later point be deemed tortious does not justify application of 14 the crime-tort exception. See In re DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d at 518–19 15 (noting “a culpable mind does not accompany every tortious act”). Plaintiffs’ new allegations, in 16 short, do not warrant granting leave to amend given they mirror allegations Plaintiffs have made 17 before. 18 2. Intrusion Upon Seclusion Claim (Florida Common Law) 19 To state a claim for intrusion upon seclusion under Florida law, a plaintiff must show an 20 intrusion onto a private place that would be highly offensive to a reasonable person. Hammer v. 21 Sorensen, 824 F. App’x 689, 695 (11th Cir. 2020). Intrusions can be either physical or electronic. 22 Spilfogel v. Fox Broad. Co., 433 F. App’x 724, 726 (11th Cir. 2011). The requirement that a 23 plaintiff must “show an intrusion into a private place and not merely a private activity” goes 24 beyond the Restatement (Second) of Torts, which has no such “private place” requirement. Id. 25 (citing Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156, 161 n.3, 162 (Fla. 2003)). Courts have 26 declined to extend Florida’s protections against the invasion of privacy tort (of which intrusion 27 upon seclusion is a subtype) to instances in which a party accesses digital files. See Celestine v. 1 Capital One, No. 17-20237-Civ, 2017 WL 2838185, at *3 (S.D. Fla. June 30, 2017) (accessing a 2 credit report does not constitute intrusion into a “place”); Bradley v. City of St. Cloud, No. 6:12– 3 cv–1348–Orl–37TBS, 2013 WL 3270403, at *5 (M.D. Fla. June 26, 2013) (similar, for medical 4 records). 5 Plaintiffs aver Oracle intruded into two private places—Plaintiff Golbeck’s home and her 6 password-protected devices—in a manner that would be highly offensive to a reasonable person. 7 Plaintiffs’ renewed attempts to argue Oracle’s collection of browsing data constitute an invasion 8 into a private place do not merit a different conclusion than that reached on Oracle’s previous 9 motion to dismiss. Targeting a household for advertising purposes is entirely different than 10 surveilling a home, just as collecting many pieces of information about an individual does not 11 transform what previously was not an intrusion into a physical place into such an intrusion. 12 Plaintiffs try to characterize online browsing as “activity taking place within the confines” of the 13 home, but, as Oracle notes, this browsing activity is “shared with website operators and her 14 internet service provider,” Dkt. 88, at 4. 15 Similarly, the fact Golbeck may have kept her devices password-protected does not change 16 the fact that her “communications with websites” constituted open conduct on the web rather than 17 activity in a private place. Dkt. 90, at 21 (citing SAC ¶ 181). As before, Golbeck cites no authority 18 for the proposition that collection of browsing data constitutes an intrusion into a private quarter. 19 “Golbeck’s conduct on the web . . . is neither password protected nor private.” Dkt. 92, at 3 n.3. 20 Since Golbeck has not plausibly alleged Oracle intruded into a “private place,” her intrusion upon 21 seclusion claim under Florida law must be dismissed. 22 IV. SEALING MOTIONS 23 The parties have filed administrative motions to seal parts of their sur-reply briefs. There is 24 a strong presumption in favor of allowing public access when deciding whether materials should 25 be sealed. See Apple Inc. v. Psystar Corp., 658 F.3d 1150, 1162 (9th Cir. 2011). A request to seal 26 must be narrowly tailored. Civ. L.R. 79-5(c)(3). To overcome the presumption in favor of public 27 access to a judicial record, there generally must be “compelling reasons supported by specific 1 factual findings.” Kamakana v. City & Cty. of Honolulu, 447 F.3d 1172, 1178 (9th Cir. 2006) 2 || (“The mere fact that the production of records may lead to a litigant's embarrassment, 3 incrimination, or exposure to further litigation will not, without more, compel the court to seal its 4 || records.”). Where a litigant presents compelling reasons to seal material, the court must then 5 balance the interests of the public and the party seeking sealing. Ctr. for Auto Safety v. Chrysler 6 Grp., LLC, 809 F.3d 1092, 1096-97 (9th Cir. 2016). This balancing test involves such factors as 7 || the public’s interest in understanding the functioning of the judicial process and the volume of 8 material sought to be sealed. See Zakinov v. Ripple Labs, Inc., No. 18-cv-6753, 2023 WL 9 |} 5280193, at *1 (N.D. Cal. Aug. 15, 2023). 10 Here, Plaintiffs and Oracle seek to redact limited portions of their sur-reply briefs. It 11 appears—as Plaintiffs represent—that the material to be sealed is at least as sensitive as 12 || information that has previously been permitted to be submitted under seal. Thus, the parties will 5 13 be permitted to file the portions of each sur-reply brief they designate as sensitive under seal.

V. CONCLUSION

3 15 Plaintiffs’ intrusion upon seclusion claim under Florida law is dismissed without leave to a 16 amend. Likewise, Plaintiffs’ ECPA claim is dismissed without leave to amend. Dismissal of both 3 17 claims without leave to amend is appropriate because amendment would be futile. The parties’ 18 administrative motions to seal are granted. Per the case schedule to which the parties previously 19 stipulated, Defendant must file an answer to the SAC within 30 days of the date of this order. 20 21 IT IS SO ORDERED. 22 23 || Dated: April 3, 2024

25 RICHARD SEEBORG _ Chief United States District Judge 26 27 98 ORDER GRANTING MOTION TO DISMISS AND GRANTING SEALING MOTIONS CASE No. 22-cv-04792-RS