Opinion · District Court, N.D. California
In Re Meta Pixel Healthcare Litigation
In Re Meta Pixel Healthcare Litig., No. 3:22-cv-03580, UP10076416 (District Court, N.D. California Sept. 7, 2023)
- Type
- Opinion
- Court
- District Court, N.D. California
- Jurisdiction
- California
- Date
- 2023-09-07
- Topic
- general
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 JOHN DOE, et al., Case No. 22-cv-03580-WHO 8 Plaintiffs, ORDER ON MOTION TO DISMISS v. 9 10 META PLATFORMS, INC., et al., Defendants. 11 12 Plaintiffs challenge defendant Meta Platform, Inc.’s alleged use of proprietary computer 13 code to obtain certain healthcare-related information of Facebook users: according to plaintiffs, 14 the Meta Pixel allows Meta to intercept personally identifiable medical information and the 15 content of patient communications from Facebook users, which Meta then monetizes for its own 16 financial gain. Plaintiffs have brought several federal and state law claims, some of which they 17 have plausibly alleged and others which need more specificity. As explained below, Meta’s 18 motion is GRANTED in part and DENIED in part. 19 BACKGROUND 20 Plaintiffs are five Facebook users who are proceeding anonymously due to the sensitive 21 nature of this litigation. Consolidated Class Action Complaint (“CCAC,” Dkt. 185) ¶¶ 24-28. 22 They allege that Meta improperly acquires their confidential health information in violation of 23 state and federal law and in contravention of Meta’s own policies regarding use and collection of 24 Facebook users’ data. Id. ¶¶ 1–2, 5, 7. 25 Each of plaintiffs’ healthcare providers—MedStar Health System, Rush University System 26 for Health, WakeMed Health & Hospitals, Ohio State University Wexner Medical Center, and 27 North Kansas City Hospital—allegedl…
Citator
UpLaw has not yet analyzed In Re Meta Pixel Healthcare Litigation. The absence of a flag is not a finding that it is good law.
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
7 JOHN DOE, et al., Case No. 22-cv-03580-WHO
8 Plaintiffs,
ORDER ON MOTION TO DISMISS
v.
9
10 META PLATFORMS, INC., et al.,
Defendants.
11
12 Plaintiffs challenge defendant Meta Platform, Inc.’s alleged use of proprietary computer
13 code to obtain certain healthcare-related information of Facebook users: according to plaintiffs,
14 the Meta Pixel allows Meta to intercept personally identifiable medical information and the
15 content of patient communications from Facebook users, which Meta then monetizes for its own
16 financial gain. Plaintiffs have brought several federal and state law claims, some of which they
17 have plausibly alleged and others which need more specificity. As explained below, Meta’s
18 motion is GRANTED in part and DENIED in part.
19 BACKGROUND
20 Plaintiffs are five Facebook users who are proceeding anonymously due to the sensitive
21 nature of this litigation. Consolidated Class Action Complaint (“CCAC,” Dkt. 185) ¶¶ 24-28.
22 They allege that Meta improperly acquires their confidential health information in violation of
23 state and federal law and in contravention of Meta’s own policies regarding use and collection of
24 Facebook users’ data. Id. ¶¶ 1–2, 5, 7.
25 Each of plaintiffs’ healthcare providers—MedStar Health System, Rush University System
26 for Health, WakeMed Health & Hospitals, Ohio State University Wexner Medical Center, and
27 North Kansas City Hospital—allegedly installed the Meta Pixel on its patient portals. See id. ¶¶
1 website, the Pixel transmitted information to Meta. Id. ¶¶ 6, 8-13, 22. They contend that this
2 information, contemporaneously redirected to Meta, revealed their status as patients and was
3 monetized by Meta for use in targeted advertising. Id. ¶¶ 9, 13.
4 Plaintiffs initially moved for a preliminary injunction. Dkt. No. 46. I denied that motion,
5 finding that while plaintiffs presented sufficient evidence of a “weighty injury,” the scope of their
6 injury and technical feasibility of plaintiffs’ proposed solutions were not clear and the balance of
7 equities and public interest factors did not support injunctive relief based on the record at that
8 juncture. Dkt. No. 159 (“PI Order”).
9 In February 2023, Interim Class Counsel filed their Consolidated Class Action Complaint.
10 Dkt. No. 185. In the CCAC, plaintiffs expand the scope of their suit and bring 13 claims: (1)
11 breach of contract; (2) breach of the duty of good faith and fair dealing; (3) violation of the
12 Electronic Communications Privacy Act (“ECPA” or “Wiretap Act”); (4) violation of the
13 California Invasion of Privacy Act (“CIPA”); (5) intrusion upon seclusion; (6) California
14 constitutional invasion of privacy; (7) negligence per se; (8) trespass to chattels; (9) violation of
15 California’s Unfair Competition Law (“UCL”); (10) violation of California’s Consumer Legal
16 Remedies Act (“CAFA”); (11) larceny; (12) violation of California’s Comprehensive Computer
17 Data Access and Fraud Act (“CDAFA”); and (13) unjust enrichment.
18 Defendant has moved to dismiss each of the claims asserted in the CCAC.1
19 LEGAL STANDARD
20 Under FRCP 12(b)(6), a district court must dismiss a complaint if it fails to state a claim
21 upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must
22 allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v.
23 Twombly, 550 U.S. 544, 570
(2007). A claim is facially plausible when the plaintiff pleads facts 24 that “allow the court to draw the reasonable inference that the defendant is liable for the 25 misconduct alleged.” Ashcroft v. Iqbal,556 U.S. 662, 678
(2009) (citation omitted). There must 26 be “more than a sheer possibility that a defendant has acted unlawfully.”Id.
While courts do not 27 1 require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a 2 right to relief above the speculative level.” Twombly,550 U.S. at 555, 570
. 3 In deciding whether the plaintiff has stated a claim upon which relief can be granted, the 4 Court accepts the plaintiff’s allegations as true and draws all reasonable inferences in favor of the 5 plaintiff. See Usher v. City of Los Angeles,828 F.2d 556, 561
(9th Cir. 1987). However, 6 the court is not required to accept as true “allegations that are merely conclusory, unwarranted 7 deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig.,536 F.3d 1049
, 8 1055 (9th Cir. 2008). If the court dismisses the complaint, it “should grant leave to amend even if 9 no request to amend the pleading was made, unless it determines that the pleading could not 10 possibly be cured by the allegation of other facts.” Lopez v. Smith,203 F.3d 1122, 1127
(9th Cir. 11 2000). In making this determination, the court should consider factors such as “the presence or 12 absence of undue delay, bad faith, dilatory motive, repeated failure to cure deficiencies by 13 previous amendments, undue prejudice to the opposing party and futility of the proposed 14 amendment.” Moore v. Kayport Package Express,885 F.2d 531
, 538 (9th Cir. 1989). 15 DISCUSSION 16 I. ELECTRONIC COMMUNICATIONS PRIVACY ACT – CLAIM 3 17 “The Wiretap Act prohibits the unauthorized ‘interception’ of an ‘electronic 18 communication.’” In re Facebook, Inc. Internet Tracking Litig.,956 F.3d 589
, 606–07 (9th Cir. 19 2020), cert. denied sub nom. Facebook, Inc. v. Davis,141 S. Ct. 1684
(2021) (quoting18 U.S.C. § 20
2511(1)(a)–(e)). To state this claim, plaintiffs must plausibly allege that Meta (1) intentionally (2) 21 intercepted (3) the contents of (4) plaintiffs’ electronic communications (5) using a device. See In 22 re Pharmatrak, Inc.,329 F.3d 9
, 18 (1st Cir. 2003) (listing ECPA elements).
23 A. Intent
24 Addressing the intent and intercept elements of the ECPA claim in the PI Order, I wrote:
25 “Intercept” is defined under the Wiretap Act as “the aural or other
acquisition of the contents of any wire, electronic, or oral
26 communication through the use of any electronic, mechanical, or
other device.” 18 U.S.C. § 2510
(4). Although the statute does not
27 define “acquisition,” the Ninth Circuit has construed the term
n.7 (9th Cir. 1998). “Such acquisition occurs when the contents of a
1 wire communication are captured or redirected in any way.” Noel v.
Hall, 568 F.3d 743, 749
(9th Cir. 2009) (internal citation and
2 quotation marks omitted).
3 According to plaintiffs, the Pixel is “designed for the very purpose
of intercepting communications on third-party websites by
4 surreptitiously and contemporaneously redirecting these
communications to Meta.” Mot. at 11 (citing Smith Decl. ¶¶ 7–14).
5 Plaintiffs have put forward evidence that Meta receives information
through the Pixel. See, e.g., Smith Decl. ¶¶ 4–5, 32–33. Meta does
6 not dispute that the intentional or interception elements are met. See
Opp. at 20–21. Plaintiffs appear likely to succeed on these two
7 elements of their claim.
8 PI Order at 18.
9 Meta points out that it did not dispute the intent element at the preliminary injunction
10 stage. It disputes it now, arguing that plaintiffs have failed to plausibly allege that Meta
11 intentionally – meaning “purposefully and deliberately and not as a result of accident or mistake,”
12 United States v. Christensen, 828 F.3d 763, 790
(9th Cir. 2015) – intended to intercept their 13 sensitive health information. It asserts that plaintiffs cannot meet this burden because the CCAC 14 acknowledges that third-party web developers, not Meta, choose whether to install Pixel and also 15 set parameters on what information to send to Meta. It also argues that intent cannot be alleged 16 because, as plaintiffs acknowledge, Meta seeks to avoid receiving sensitive information by 17 contractually forbidding developers from sending it and filtering out any potentially sensitive data 18 it detects on the back end. Mot at 5-6 (citing CCAC ¶¶ 39, 44-46 (Pixel is customizable per 19 instructions provided by Meta), 118, 125, 148-149 (Meta has systems in place to filter sensitive 20 information and, has publicly stated it does not want sensitive health information)). 21 While plaintiffs acknowledge that Meta may tell third parties and Facebook users that it 22 intends to prevent receipt of sensitive health information, plaintiffs contend that is not what Meta 23 really intends. See, e.g., CCAC ¶¶ 122-123, 144-146, 150, 161 (plaintiffs allege Meta’s tools and 24 filters are not effective, not fully implemented, and call into question Meta’s true intent). What 25 Meta’s true intent is, what steps it actually took to prevent receipt of health information, the 26 efficacy of its filtering tools, and the technological feasibility of implementing other measures to 27 prevent the transfer of health information, all turn on disputed questions of fact that need 1 (N.D. Cal. 2021) (“At the pleading stage, however, interception may be considered intentional 2 ‘where a defendant is aware of the defect causing the interception but takes no remedial action.’”) 3 (quoting In re Google Assistant Priv. Litig.,457 F. Supp. 3d 797
, 815 (N.D. Cal. 2020)). At this 4 stage, intent has been adequately alleged. 5 B. Content 6 Meta also argues that plaintiffs have not and cannot plausibly plead interception of covered 7 “content.” The statute broadly defines “content” to include “any information concerning the 8 substance, purport, or meaning of [a] communication.”18 U.S.C. § 2510
(8). “Contents” refers to 9 the “intended message conveyed by the communication”—it does not include record information 10 regarding the characteristics of the message that is generated in the course of the communication. 11 See In re Zynga Priv. Litig.,750 F.3d 1098, 1106
(9th Cir. 2014). For instance, contact 12 information provided as part of a sign-up process constitutes “content” because this information is 13 the subject of the communication.Id. at 1107
(“Because the users had communicated with the 14 website by entering their personal medical information into a form provided by the website, the 15 First Circuit correctly concluded that the defendant was disclosing the contents of a 16 communication.”). And while a URL that includes “basic identification and address information” 17 is not “content,” a URL disclosing a “search term or similar communication made by the user” 18 “could constitute a communication” under the statute.Id.
at 1108–09.
19 In the PI Order, I found that plaintiffs had made a strong showing on this element:
20 In my view, the log-in buttons and the kinds of descriptive URLs
identified in the Smith Decl. are “contents” within the meaning of the
21 statute. Unlike in Zynga, the URLs at issue here would not merely
reveal the name of a Facebook user or group—as Smith explained,
22 the transmitted URLs include both the “path” and the “query string.”
Smith Decl. ¶¶ 50–51; see also id. ¶ 189 (showing
23 hardfordhospital.org/services/digestive-health/conditions-we-
treat/colorectal-small-bowel-disorders/ulcerative-colitis URL).
24 These items are content because they concern the substance of a
communication. See Zynga, 750 F.3d at 1107
; In re Google Inc. 25 Cookie Placement Consumer Priv. Litig.,806 F.3d 125, 137
(3d Cir.
2015) (“If an address, phone number, or URL is . . . part of the
26 substantive information conveyed to the recipient, then by definition
it is ‘content.’”); see also In re Google RTB Consumer Priv. Litig.,
27 No. 21-cv-2155-YGR, 2022 WL 2165489
, at *10 (N.D. Cal. June 13,
navigation to the current page constituted “content”).
1
PI Order at 19. Meta acknowledges this prior conclusion, but argues that unspecified “remaining
2
items” that are transferred “mostly” do not qualify as content and claims based on “those
3
communications” should be dismissed. Mot. at 9-10; Reply at 4.
4
At this juncture, plaintiffs have adequately alleged covered content is transferred. The
5
boundaries of what transferred information is content under the Act is better determined on a full
6
evidentiary record.
7
C. Consent
8
Finally, Meta argues that the ECPA’s one-party consent exemption (exempting liability for
9
intercepted information resulting from one party’s consent) bars the claim as a matter of law.
10
Meta points out, again, that it is the third-party web developers who make their Pixel-enhanced
11
websites available to plaintiffs and their other healthcare customers, and by doing so those
12
healthcare entities have necessarily consented to the transmission of data to Meta.
13
In the PI Order, I explained:
14
[T]he Wiretap Act exempts liability in certain circumstances. The
15 statute provides that:
16 It shall not be unlawful under this chapter for a person not
acting under color of law to intercept a wire, oral,
17 or electronic communication where such person is a party to
the communication or where one of the parties to the
18 communication has given prior consent to such interception
unless such communication is intercepted for the purpose of
19 committing any criminal or tortious act in violation of the
Constitution or laws of the United States or of any State.
20
18 U.S.C. § 2511
(2)(d). In other words, the Wiretap Act allows
21 interception where the interception is made by a “party” to the
communication or where a “party” has consented to the interception.
22 Id.
This exception does not apply, however, where the interceptor
acts “for the purpose of” committing any crime or tort in violation of
23 state or federal law. Id.
24 PI Order at 20.2
25
2 In the PI Order, I “put aside” the issue of consent and considered whether the “crime or tort”
26
“exception to the exception” applied. I concluded there was a “not-insignificant chance, then, that
plaintiffs may be able to show that the crime-tort exception applies,” but “in light of the authority
27
in this district finding that liability does not lie where a defendant’s primary motivator was to
1 On this motion to dismiss, the issue of consent is front and center and the burden of proof
2 to show this exemption applies is on Meta. See In re Google RTB Consumer Priv. Litig., 606 F. 3
Supp. 3d 935, 949 (N.D. Cal. 2022). In support of dismissal, Meta relies on Katz-Lacabe v. 4 Oracle Am., Inc., No. 22-CV-04792-RS,2023 WL 2838118
, at *10 (N.D. Cal. Apr. 6, 2023). 5 There, plaintiffs challenged Oracle’s collection of “personal information from internet users” by 6 “synchroniz[ing] that data to create individual profiles, and ultimately sell[ing] that data— 7 bolstered by data made available by its partners—on its Data Marketplace.” The court dismissed 8 the ECPA claim because, “[a]s Defendant's customers must have chosen to deploy Oracle’s tools 9 on their websites, it necessarily follows that ‘one of the parties to the communication’—the 10 websites themselves—gave ‘prior consent to such interception.’” Id. at *210 (relying on 11 Rodriguez v. Google LLC, No. 20-cv-04688-RS,2021 WL 2026726
, at *6 (N.D. Cal. May 21, 12 2021). 13 Plaintiffs counter with Brown v. Google LLC, No. 4:20-CV-3664-YGR,2023 WL 14
5029899, at *9 (N.D. Cal. Aug. 7, 2023). There, the court rejected summary judgment on the 15 consent issue under the ECPA claim, despite the defendant having “generally disclosed” its data 16 tracking practices, because it also “promote[d] the privacy afforded by Incognito” as a browsing 17 mode.Id.
In that situation, Google “itself created a situation where there is a dispute as to whether 18 users’ consent of Google’s data collection generally is ‘substantially the same’ as their consent to 19 the collection of their private browsing data in particular.”Id.
20 The facts alleged here – that while Meta disclosed its purported attempts to prevent third- 21 party developers who incorporated the Pixel from sending sensitive data to Meta, Meta in fact 22 intended to receive and did receive that sensitive data – bring this case closer to Brown.Id.,
202323 WL 5029899
*7 (“For consent to be actual, the disclosures must ‘explicitly notify’ users of the
24 practice at issue.”). Meta has not pointed to anything I can judicially notice on this motion to
25 dismiss to show as a matter of law that the healthcare providers did not just presumably but
26
27
differently in a motion to dismiss context,” and recognized that the “parties will have the
1 actually consented to the sending of sensitive healthcare information of its customers.
2 Determination of whether actual consent was given depends on what Meta disclosed to healthcare
3 providers, how it described and trained healthcare providers on the Pixel, and how the healthcare
4 providers understood the Pixel worked and the information that then could or would be collected
5 by Meta. These evidence-bound determinations are inappropriate to reach on this motion.
6 Meta’s motion to dismiss the ECPA claim is DENIED.
7 II. CALIFORNIA INVASION OF PRIVACY ACT – CLAIM 4
8 In the PI Order, I concluded that plaintiffs had adequately alleged and supported their
9 CIPA claim under both sections 631(a) and 632, based on Meta’s challenges to “content” under
10 631(a) and “confidential communications” under 632. PI Order at 23-24. Meta now moves to
11 dismiss the California state law analog to the ECPA, raising arguments not addressed in my PI
12 Order.
13 A. Extraterritoriality
14 Meta initially argues that CIPA does not apply “extraterritorially,” because CIPA’s intent
15 is “to protect the right of privacy of the people of this state.” Cal. Penal Code § 630
. As none of 16 the named plaintiffs are California residents, Meta contends the CIPA claim must be dismissed. 17 I disagree for three reasons. First, this contention is arguably premature. Kellman v. 18 Spokeo, Inc.,599 F. Supp. 3d 877
, 894 (N.D. Cal. 2022), motion to certify appeal denied, No. 19 3:21-CV-08976-WHO,2022 WL 2965399
(N.D. Cal. July 8, 2022) (deferring choice of law 20 analyses until class certification, after discovery shed light on whether defendants’ acts had a 21 substantial nexus to California). 22 Second, plaintiffs have plausibly alleged that the conduct at issue, in terms of the design 23 and marketing of the Pixel technology and development and implementation of its Terms of 24 Service, occurred in California;. See, e.g., Schmitt v. SN Servicing Corp., No. 21-CV-03355- 25 WHO,2021 WL 3493754
, at *3 (N.D. Cal. Aug. 9, 2021) (data breach allegations regarding 26 defendant who operated out of California “sufficient to allow out-of-state plaintiffs to seek 27 recovery under California law”); Valentine v. NebuAd, Inc.,804 F. Supp. 2d 1022, 1028
(N.D. 1 is not inconsistent with also allowing non-Californians to pursue claims against California 2 residents.”); see also Oman v. Delta Air Lines, Inc.,889 F.3d 1075, 1079
(9th Cir. 2018), certified 3 question accepted sub nom. Oman v. Delta Air Lines, No. S248726,2018 WL 10809386
(Cal. July 4 11, 2018), and certified question answered,9 Cal. 5th 762
(2020) (“If the conduct that ‘creates 5 liability’ occurs in California, California law properly governs that conduct.”). 6 Third, Facebook’s Terms of Service specify that California law applies to disputes between 7 Facebook and its users. CCAC ¶ 292. That alone may not be dispositive, but it supports allowing 8 these non-resident plaintiffs to assert a claim against a California resident under CIPA. See 9 Maldonado v. Apple, Inc, No. 3:16-CV-04067-WHO,2021 WL 1947512
, at *6 (N.D. Cal. May 10 14, 2021) (“California Supreme Court held that choice-of-law clauses in contracts are generally 11 enforceable and laid out a multipart test to determine whether to follow the contracted-for 12 jurisdiction’s law or disregard it.”). 13 I am not determining or foreclosing any choice-of-law issues. Choice-of-law has not been 14 squarely raised. I am denying the motion to dismiss the CIPA claim based on Meta’s 15 exterritoriality argument. 16 B. Intent 17 Meta also argues plaintiffs fail to allege plausible facts to support the intent element of 18 CIPA, which requires a showing of Meta’s “affirmative desire” to intercept communications. 19 Intent under CIPA is determined consistently with intent under ECPA, and for the same reasons as 20 discussed above, intent has been adequately alleged. Whether Meta’s affirmative disclosures and 21 back-end filtering process sufficiently negate intent depends on Meta’s knowledge as well as its 22 implementation and the efficacy of its alleged contractual efforts and back-end filtering. Those 23 will be tested on an evidentiary record. Similarly, Meta’s point that Pixel captures some data that 24 healthcare entities may permissibly share with Meta might provide a defense to some portion of 25 plaintiffs’ CIPA claim, but it does not negate the plausible allegations that sensitive healthcare 26 information is intentionally captured and transmitted to Meta. 27 C. Sent or Received 1 sent from, or received at any place within this state,”Cal. Penal Code § 631
(a), and argues 2 plaintiffs have not plausibly alleged that plaintiffs’ information was being sent to or received from 3 a place in this state. Plaintiffs plead that Meta is headquartered in California and Meta “designed 4 and effectuated its scheme to track the patient communications at issue here from California.” 5 CCAC ¶ 369 (emphasis added). That is sufficient at this stage. 6 D. Device 7 The last CIPA challenge is whether the Pixel is a “device” under Section 632(a) because it 8 is a piece of software. Meta points out that two judges in this District, when considering 9 “electronic tracking devices” under Penal Code section 637.7(d), have rejected the argument that 10 tracking software are “devices.” See In re Google Location Hist. Litig.,428 F. Supp. 3d 185
, 193 11 (N.D. Cal. 2019) (Davila, E.) (Google maps software and related “services are not a ‘device’ 12 within the meaning of Section 637.7(d).”); In Moreno v. San Francisco Bay Area Rapid Transit 13 Dist.,2017 WL 6387764
, at *5 (N.D. Cal. Dec. 14, 2017) (Corley, J.) (an “electronic tracking 14 device” does not include “software installed in mobile devices”). 15 Plaintiffs respond that the section 637.7 cases so not apply to this section 632(a) case. 16 They instead discuss decisions construing and interpreting CIPA consistently with the ECPA 17 which hold that servers or software qualify as “devices” under the ECPA. Oppo. at 10 n.2.3 Most 18 on point is In re Carrier IQ, Inc.,78 F. Supp. 3d 1051, 1084
(N.D. Cal. 2015). There, plaintiffs 19 alleged that a software application, once installed on users’ phones, “surreptitiously intercepted 20 personal data and communications and transmitted this data to Carrier IQ and its customers.”Id.
21 The Honorable Edward M. Chen held that “plaintiffs have sufficiently alleged that the Carrier IQ 22 Software is a ‘device’ for purposes of the Wiretap Act.”Id. at 1084
. The section 637.7 cases are
23
24
3 A few of the cases plaintiffs rely on are not truly in support. For example, in United States v.
Szymuszkiewicz, 622 F.3d 701, 707
(7th Cir. 2010), as amended (Nov. 29, 2010), the court held
25
that the defendant “acquired the emails by using at least three devices: Infusino’s computer (where
the rule was set up), the Kansas City server (where the rule caused each message to be duplicated
26
and sent his way), and his own computer (where the messages were received, read, and sometimes
stored).” In Lopez v. Apple, Inc., 519 F. Supp. 3d 672
, 690 (N.D. Cal. 2021), the court simply
27
found that “Apple used the devices [iPhone] by programming Siri software to intercept
1 distinguishable, and absent contrary authority under section 632(a), I agree that the Pixel software
2 is a device under section 632(a).
3 Meta’s motion to dismiss the CIPA claim is DENIED.
4 III. CONSTITUTIONAL PRIVACY (CLAIM 6) AND INTRUSION ON SECLUSION
(CLAIM 5)
5
Addressing the invasion of privacy and intrusion on seclusion claim in the PI Order, I
6
explained that plaintiffs had shown enough to demonstrate a reasonable expectation of privacy in
7
their medical communications (despite Meta’s policies generally disclosing its collection of data
8
from users and its disclosures that it would require partners to obtain lawful rights to share
9
protected user data) and that Meta’s conduct was highly offensive. PI Order at 24-27. Meta
10
argues here that the California’s constitutional privacy protections do not apply extraterritorially
11
and plaintiffs have failed to adequately allege their sensitive information was received by Meta.
12
As with CIPA, plaintiffs have plausibly alleged that the conduct causing them harm
13
occurred in and emanated from California. That is sufficient at this juncture.
14
Concerning the protected interest, Meta argues that plaintiffs have failed to plausibly allege
15
a violation of their constitutionally protected privacy interests because the named plaintiffs fail to
16
identify with specificity what, if any, private or particularly sensitive information about them Meta
17
allegedly received. Meta is correct that these named plaintiffs do not identify in the CCAC what
18
specific, personal or private information they conveyed to their healthcare providers that they
19
reasonably believe Meta received.
20
In opposition, plaintiffs do not dispute this or identify any particular categories of
21
information that they shared with their healthcare providers that they reasonably believe was
22
captured by Meta. Instead, they rely on In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 23
589 (9th Cir. 2020) to argue they do not need to disclose the specific information they contend
24
Meta received. But in that case, there was no dispute that Facebook collected “a full-string
25
detailed URL, which contains the name of a website, folder and sub-folders on the web-server, and
26
the name of the precise file requested,” when it operated. Id. at 605. Here, as Meta repeatedly
27
points out and plaintiffs admit, there is information collected by the Pixel software that does not
1 constitute sensitive, personal information.
2 Given the nature of this case – where plaintiffs allege that both unprotected and
3 constitutionally protected information was captured by Meta’s Pixel – plaintiffs are required to
4 amend to describe the types or categories of sensitive health information that they provided
5 through their devices to their healthcare providers. That basic amendment (which can be general
6 enough to protect plaintiffs’ specific privacy interests) will allow these privacy claims to go
7 forward.4
8 Plaintiffs’ invasion of privacy claims are DISMISSED with leave to amend.
9 IV. CALIFORNIA’S COMPREHENSIVE COMPUTER DATA ACCESS AND FRAUD
ACT – CLAIM 12
10
CDAFA provides that only an individual who has “suffer[ed] damage or loss by reason of
11
a violation” of the statute may bring a civil action “for compensatory damages and injunctive
12
relief or other equitable relief.” Cal. Penal Code § 502
(e)(1). CDAFA permits recovery of
13
“[c]ompensatory damages [that] include any expenditure reasonably and necessarily incurred by
14
the owner or lessee to verify that a computer system, computer network, computer program, or
15
data was or was not altered, damaged, or deleted by the access.” Id.
16
A. Loss or Damage
17
Meta initially seeks dismissal of plaintiffs’ CDAFA claim because plaintiffs have not
18
alleged and cannot allege “damage or loss” in an action like this that is based on privacy violations
19
as opposed to an intrusion that impacts the performance or operation of computer devices. Meta
20
relies on a recent decision from Chief Magistrate Judge Donna M. Ryu, Cottle v. Plaid Inc., 536 F. 21
Supp. 3d 461 (N.D. Cal. 2021), where Judge Ryu rejected a theory of loss or damage under
22
CDAFA based on the “loss of the right to control their own data, the loss of the value of their data,
23
24
4 Related to the “legally protected interest” argument, Meta also contends that the privacy claims
fail because plaintiffs have not alleged a “sufficiently serious” invasion of their privacy rights.
25
Once plaintiffs amend to identify the types of protected information they shared with their
healthcare providers and was likely captured by Meta, they will have plausibly alleged a
26
sufficiently serious impact on their privacy rights. See PI Order at 26-27. Meta’s remaining
arguments, that its filtering efforts and purported use of any received healthcare information are
27
highly relevant to whether its conduct is “highly offensive,” have merit. Mot. at 14-15. But the
1 and the loss of the right to protection of the data,” as that type of loss was not covered by the
2 statute. Id.
at 488 (citing Nowak v. Xapo, Inc., No. 5:20-cv-03643-BLF,2020 WL 6822888
, at *4-
3 5 (N.D. Cal. Nov. 20, 2020) (dismissing CDAFA claim based on loss of value of stolen
4 cryptocurrency in part because the nature of the loss was not cognizable under CDAFA)).
5 Plaintiffs respond that they adequately allege actionable “loss or damage” under CDAFA
6 by alleging: (1) the Pixel “has precluded” them from being able to communicate with their
7 healthcare providers through their computers or otherwise and (2) their protected information is
8 diminished in value. Plaintiffs cite a number of cases from this District that they claim support
9 these types of damages under CDAFA. However, each of the cases plaintiffs rely on dealt with
10 different sections of CDAFA or allegations of impaired device performance. Oppo. at 13.5
11 Plaintiffs provide no support for their argument that an “inability” to use their computer
12 devices to communicate with their healthcare providers in the future is a cognizable form of loss
13 or damage actionable under the CDAFA. Their diminished value of information claim is
14 foreclosed by the reasoning in Cottle.
15 Plaintiffs indicated at the hearing that they might be able to plead a different theory of
16 impairment of their computing devices. They may do so. The CDAFA claim is DISMISSED,
17 with leave to amend.
18 B. Other CDAFA Elements
19 Meta also attacks the substance of the CDAFA claim. The CCAC relies on various
20 substantive sections of CDAFA: sections 502(c)(1), (c)(2), (c)(3), (c)(6), (c)(7), and (c)(8). In
21 opposition plaintiffs address only (1) and (8).6 In their further amended CCAC, plaintiffs shall
22
5 See In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 454
(N.D. Cal. 2018), on
23
reconsideration in part, 386 F. Supp. 3d 1155
(N.D. Cal. 2019) (addressing (c)(4) and (c)(5) and
allegations of device impairment); Ubisoft, Inc. v. Kruk, No. CV 20-478-DMG (ASX), 2021 WL 24
3472833, at *4 (C.D. Cal. July 9, 2021) ((c)(5) claim alleging DDoS attacks); In re Carrier IQ,
Inc., 78 F. Supp. 3d 1051, 1067
(N.D. Cal. 2015) (alleging impact on battery life and
25
performance); see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599
(9th Cir.
2020) (finding Article III standing to allege CDAFA claim, but not addressing standing under the
26
“loss or damage” requirement of the statute).
27
6 These provisions hold persons liable for “(1) Knowingly accesses and without permission alters,
1 limit the CDAFA claim to these two subsections only.
2 Meta argues that plaintiffs have not alleged a claim under (1) because intent has not been
3 sufficiently alleged. Consistent with the ECPA and CIPA discussions above, however, plaintiffs
4 have adequately alleged intent. Meta next contends that plaintiffs cannot plausibly allege a claim
5 under (8), as it was the healthcare entities’ web developers who introduced Pixel onto their own
6 websites, not Meta. Plaintiffs’ allegations regarding how Meta induced or encouraged those
7 entities to adopt and install the Pixel suffice at this juncture.
8 Meta also asserts that even if it could be vicariously liable, plaintiffs have not alleged and
9 cannot plausibly allege that the Pixel is a prohibited “contaminant.”7 In In re iPhone Application
10 Litig., No. 11-MD-02250-LHK, 2011 WL 4403963
(N.D. Cal. Sept. 20, 2011) the court explained:
11 Section 502(c)(1[2]) defines “computer contaminant” as “any set of
computer instructions that are designed to modify, damage, destroy,
12 record, or transmit information within a computer, computer system,
or computer network without the intent or permission of the owner of
13 the information. They include, but are not limited to, a group of
computer instructions commonly called viruses or worms. . . to
14 contaminate other computer programs or computer data, consume
computer resources, modify, destroy, record, or transmit data, or in
15 some other fashion usurp the normal operation of the computer,
computer system, or computer network.” See Cal.Penal Code § 502(b)
16 (10) (emphasis added). Thus, the very definition of a “computer
contaminant” limits liability to conduct that occurs “without the intent
17 or permission of the owner of the information.” Moreover, the section
on “computer contaminants” appears to be aimed at “viruses or
18 worms,” and other malware that usurps the normal operation of the
computer or computer system. Although Plaintiffs[] are given leave
19 to amend to clarify their allegations in an amended complaint, it is not
clear to the Court how Section 502(c)(8) applies to the case at hand.”
20
Id. at *13.
21
22
extort, or (B) wrongfully control or obtain money, property, or data” and (8) “Knowingly
23
introduces any computer contaminant into any computer, computer system, or computer network.”
Cal. Penal Code § 502
(c).
24
7 Cal. Penal Code § 502
(12) “‘Computer contaminant’ means any set of computer instructions
25
that are designed to modify, damage, destroy, record, or transmit information within a computer,
computer system, or computer network without the intent or permission of the owner of the
26
information. They include, but are not limited to, a group of computer instructions commonly
called viruses or worms, that are self-replicating or self-propagating and are designed to
27
contaminate other computer programs or computer data, consume computer resources, modify,
1 Whether plaintiffs can, on amendment, plausibly allege facts establishing recognized “loss
2 or damage” sufficient to state a claim under CDAFA will also inform whether the Pixel is a
3 contaminant that “usurps” the normal operation of plaintiffs’ devices. See also Flextronics Int'l,
4 Ltd. v. Parametric Tech. Corp., No. 5:13-CV-00034-PSG, 2014 WL 2213910
, at *5 (N.D. Cal. 5 May 28, 2014) (“a plaintiff need only allege that the actions of the contaminant 6 (modify/damage/destroy/record/ transmit) were undertaken by overcoming a technical barrier 7 without the permission of the owner; the introduction of the contaminant to the system need not 8 surmount the same hurdle.”). 9 The motion to dismiss the CDAFA claim is GRANTED with leave to amend. 10 V. BREACH OF CONTRACT – CLAIMS 1 & 2 11 A. Limitation of Liability in Meta’s Terms of Service 12 Meta argues initially that a “limitation of liability” clause in its TOS bars the breach of 13 contract claims. That clause provides: “[Meta]’s liability shall be limited to the fullest extent 14 permitted by applicable law, and under no circumstance will we be liable to you for any lost 15 profits, revenues, information, or data, or consequential, special, indirect, exemplary, punitive, or 16 incidental damages arising out of or related to these Terms or the Meta Products.” Meta RJN Ex. 17 1 at 7.8 18 Meta notes that at least one court in this District has applied Meta’s limitation provision to 19 defeat express and implied contract claims, rejecting the argument that the limitation provision 20 was unconscionable. See Bass v. Facebook, Inc.,394 F. Supp. 3d 1024
, 1037 (N.D. Cal. 2019) 21 (“Perhaps regrettably, ‘[w]ith respect to claims for breach of contract, limitation of liability 22 clauses are enforceable unless they are unconscionable, that is, the improper result of unequal 23 bargaining power or contrary to public policy.’ Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 24209 Cal. App. 4th 1118, 1126
,147 Cal.Rptr.3d 634
(2012).”). The Bass court then determined
25 that the limitations provision was not unconscionable as applied to the contract and quasi-contract
26
27
8 Meta seeks judicial notice of various documents, including its TOS, Business Tools Terms,
1 causes of action. Id. at 1038; see also Darnaa, LLC v. Google LLC, 756 F. App'x 674
, 676–77 2 (9th Cir. 2018) (rejecting unconscionability argument, “[a]s interpreted by California courts, 3 Section 1668 generally does not prohibit parties from limiting liability for breach of contract, 4 including breach of the implied covenant. [citations omitted]. We see no reason to depart from this 5 principle here.”). 6 Plaintiffs respond that Meta’s attempt to limit its liability for the breach claim runs afoul of 7 California Civil Code section 1668. It provides: “All contracts which have for their object, 8 directly or indirectly, to exempt anyone from responsibility for his own fraud, or willful injury to 9 the person or property of another, or violation of law, whether willful or negligent, are against the 10 policy of the law.” Here, because defendants acted intentionally by refusing to stop the data 11 transfer or employ a stronger filter mechanism, plaintiffs assert that section 1668 comes into play 12 even for a breach of contract claim. On that basis, they distinguish Bass from this case as Bass 13 concerned a negligent data breach case caused by an obscure flaw in Meta’s code and Meta took 14 immediate action to fix it. 15 In addition to the substantive differences between the allegations in Bass and this case, 16 plaintiffs also note that other courts in this district have allowed breach of contract claims to 17 continue against Facebook despite the limitation of liability clause. See, e.g., Lundy v. Facebook 18 Inc., No. 18-CV-06793-JD,2021 WL 4503071
, at *2 (N.D. Cal. Sept. 30, 2021) (“For the 19 damages element of plaintiffs’ contract and quasi-contract claims, plaintiffs have adequately 20 pleaded claims for disgorgement and nominal damages. [] These types of damages are not 21 covered by the limitation of liability provision Facebook points to in its motion to dismiss. [] 22 Nominal damages may be recovered for a breach of contract under California law.” (internal 23 citations omitted)); Shared.com v. Meta Platforms, Inc., No. 22-CV-02366-RS,2022 WL 24
4372349, at *4 (N.D. Cal. Sept. 21, 2022) (allowing breach of contract and other claims to
25 proceed past motion to dismiss stage despite limitation of liability clause because the “discovery
26 process would aid in determining more concretely whether each claim avers direct or indirect
27 damages. The limitations provision will therefore not mandate dismissal of any of Plaintiff’s
1 for summary judgment”).
2 Here, plaintiffs have pleaded entitlement to nominal damages and restitution. CCAC ¶
3 317. Given the differences between the damages sought as well as the intentional conduct alleged
4 (distinguishing this case from Bass), the breach of contract claims will not be dismissed based on
5 the limitation of liability clause. Meta may, however, move to limit the types of damages
6 available (e.g., anything beyond nominal damages) on summary judgment or at another
7 appropriate juncture.
8 B. Sufficiently Definite Promises and Breach
9 Next Meta argues that the contractual provisions on which plaintiffs based their breach of
10 contract claim are not “sufficiently definite.” The specific contractual promises made in Meta’s
11 Privacy Policy and TOS and plaintiffs’ allegations regarding breach are identified at paragraph
12 312 in the CCAC:
13
• “We require Partners to have the right to … share your information before giving it to us.”
14
Plaintiffs allege: “Meta does not require Partners to have the right to share health
15 information with Meta before giving it to Meta.”
16 • “We employ dedicated teams around the world … to detect potential misuse of our
Products, harmful conduct towards others, and situations where we may be able to help
17
support or protect our community.”
18
Plaintiffs allege: “Meta does not employ dedicated teams to prevent its
19 unauthorized acquisition of health information. To the contrary, Meta employs
dedicated teams to encourage health entities to share health information with Meta
20 that the health entities lack rights to share.”
21
• “We … develop advanced technical systems to detect potential misuse of our Products,
22 harmful conduct towards others, and situations where we may be able to help support or
protect our community. If we learn of content or conduct like this, we will take appropriate
23 action – for example … removing content, blocking access to certain features, disabling an
account, or contacting law enforcement.”
24
25 Plaintiffs allege: “Meta has developed advanced technical systems to detect
potential misuse of certain products and is fully capable of using those systems to
26 detect Pixel Partners from which it is acquiring health information without
authorization. However, Meta has not used those systems to stop acquiring such
27 information and has not taken appropriate action to prevent health entities from
1
• “We work with external service providers, partners, and other relevant entities … to detect
2 potential misuse of our Products, harmful conduct towards others, and situations where we
may be able to help support or protect our community, including to respond to user reports
3 of potentially violating content.”
4 Plaintiffs allege: “Meta does not work with external service providers, Partners, or
other relevant entities to detect potential misuse of sending health information to
5
Meta through the Pixel without the right to do so. To the contrary, Meta works with
6 Partners to help those Partners avoid the meaningless restrictions Meta places on
ads that are targeted to health. As shown above, Meta teaches health entities how to
7 avoid its “restrictions” on personalized health targeted ads by removing certain
words that would give users the idea that the ad was specifically targeted to them,
8 all the while continuing to target ads to specific users based on personal attributes,
including health.”
9
CCAC ¶ 312; see also ¶¶ 96-97 (noting Meta “requires” some information including sensitive and
10
protected information from users for services to work), 117 (same).9 Plaintiffs’ specific references
11
to identified provisions in Meta’s TOS and Privacy Policy are sufficiently definite to “determine
12
the scope of the duty and the limits of performance must be sufficiently defined to provide a
13
rational basis for the assessment of damages.” Ladas v. California State Auto. Assn., 19 Cal. App. 14
4th 761, 770 (1993).
15
Plaintiffs have also plausibly alleged that Meta breached the promises. Meta overreads the
16
impact of plaintiffs’ “admissions” that Meta may have “discouraged” partners from sending
17
sensitive or protected information and Meta employed a filter to reduce the transfer of sensitive or
18
protected information. Meta ignores plaintiffs’ detailed and plausible allegations regarding how
19
and why the transfer of sensitive or protected information is necessary for Meta’s advertising
20
services to function in the way Meta advertised those services, as well as allegations that Meta
21
knew its filter was not effective and could have improved its filter or taken other steps to block the
22
transfer of the sensitive or protected information. That is sufficient at this juncture.
23
The motion to dismiss the breach of contract and related breach of the duty of good faith
24
and fair dealing claims is DENIED.10
25
26
99 In addressing consent at the preliminary injunction stage, as both sides here note, I expressed
that Meta’s use of the term “require” was susceptible to multiple meanings. PI Order at 16.
27
VI. UNJUST ENRICHMENT – CLAIM 13
1
Meta moves to dismiss the unjust enrichment claim, which California law construes as a
2
quasi-contract claim, in light of plaintiffs’ express contract claim. But plaintiffs may plead this
3
claim as an alternative at this juncture, even if the contract claim can be read to cover plaintiffs’
4
allegation that Meta sold their data without consent and unjustly retained the proceeds. See
5
Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762
(9th Cir. 2015). Meta also argues that the
6
claim cannot stand as plaintiffs have failed to plead that they lack adequate remedies at law under
7
Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844
(9th Cir. 2020). But plaintiffs do allege that
8
their remedies at law are inadequate. See CCAC ¶¶ 448, 489.
9
The motion to dismiss the unjust enrichment claim is DENIED.
10
VII. NEGLIGENCE PER SE – CLAIM 7
11
Under California law, negligence per se is not a separate cause of action, but a negligence
12
claim analyzed under the per se doctrine. See Dent v. Nat'l Football League, 902 F.3d 1109
, 1118
13
(9th Cir. 2018). Under that doctrine, the standard of care can be established by a statute, and a
14
defendant’s violation of that statue can “give rise to a presumption that it failed to exercise due
15
care” where that violation “proximately caused an injury,” the injury resulted from something the
16
statute was designed to prevent, and the person who was injured was “one of the class of persons
17
for whose protection the statute, ordinance, or regulation was adopted.” Id.
(internal citations
18
omitted). However, the basic elements of a negligence claim, including duty of care and
19
causation, must still be alleged. See Quiroz v. Seventh Ave. Ctr., 140 Cal. App. 4th 1256
, 1285
20
(2006).
21
Meta attacks plaintiffs’ attempt to plead a breach of the duty of care required to state a
22
negligence-based claim. Plaintiffs’ only identified source of duty is HIPAA, and at least one court
23
this District and another within the Ninth Circuit have rejected HIPAA as a basis of a negligence
24
per se claim. See, e.g., Austin v. Atlina, No. 20-CV-6363-YGR, 2021 WL 6200679
, at *3 (N.D.
25
26
Oppo. at 17. As construed, the claim is not merely duplicative of or exceeding the obligations
imposed by the contractual provisions plaintiffs rely on for their express breach claim. Plaintiffs
27
have also adequately Meta’s intent – conscious and deliberative acts – given the breach allegations
1 Cal. Dec. 22, 2021) (“Because there is no private right of action under HIPAA, plaintiff’s HIPAA
2 claim is not cognizable under common law”); Teeter v. Easterseals-Goodwill N. Rocky Mountain,
3 Inc., No. CV-22-96-GF-BMM, 2023 WL 2330241
, at *4 (D. Mont. Mar. 2, 2023) (dismissing 4 negligence per se cause of action based on HIPAA); see also Delta Sav. Bank v. United States, 2655 F.3d 1017, 1026
(9th Cir. 2001) (“[t]o bring suit under the FTCA based on negligence per se, a 6 duty must be identified, and this duty cannot spring from a federal law. The duty must arise from 7 state statutory or decisional law, and must impose on the defendants a duty to refrain from 8 committing the sort of wrong alleged here,” and citing authority explaining “[t]he pertinent inquiry 9 is whether the duties set forth in the federal law are analogous to those imposed under local tort 10 law”) (quotations omitted); In re: Netgain Tech., LLC, No. 21-CV-1210 (SRN/LIB),2022 WL 11
1810606, at *16 (D. Minn. June 2, 2022) (“Here, Plaintiffs have not cited any precedent in 12 California, Minnesota, Nevada, South Carolina, or Wisconsin that permits a state-law negligence 13 per se claim to proceed based on the theory that there is a violation of Section 5 of the FTC Act.”); 14 but see In re Ambry Genetics Data Breach Litig.,567 F. Supp. 3d 1130
, 1143 (C.D. Cal. 2021) 15 (allowing negligence/negligence per se claim based on violations of FTCA and HIPAA to 16 proceed).11 17 Following the majority of the cases that have considered the issue, the negligence per se 18 claim based on a duty created by HIPAA is DISMISSED with leave to amend so that plaintiffs 19 may attempt to identify a state law source of the duty of care. 20 VIII. TRESPASS TO CHATTELS – CLAIM 8 21 Under California law, trespass to chattels “lies where an intentional interference with the 22 possession of personal property has proximately caused injury.” Intel Corp. v. Hamidi,30 Cal.4th 23 1342
, 1350–51,1 Cal.Rptr.3d 32
,71 P.3d 296
(2003). This claim does not lie where injuries are 24 to privacy and confidentiality. See Casillas v. Berkshire Hathaway Homestate Ins. Co.,79 Cal. 25
26
11 Meta also challenges plaintiffs’ ability to plausibly please causation for a negligence claim,
given plaintiffs’ admission that the healthcare providers’ web developers, not Meta, choose what
27
information the Pixel sends to Meta. Mot. at 21. Given plaintiffs’ plausible allegations that Meta
1 App. 5th 755, 765 (2022). In cases of interference with possession of personal property not
2 amounting to conversion “‘the owner has a cause of action for trespass or case, and may recover
3 only the actual damages suffered by reason of the impairment of the property or the loss of its
4 use.’” Hamidi, at 1351 (emphasis in original, quoting Zaslow v. Kroenert, 29 Cal. 2d 541
, 551 5 (1946)); see also id. 1353 (where there was “no actual or threatened damage to [plaintiff's] 6 computer hardware or software and no interference with its ordinary and intended operation,” the 7 defendant's trespass was not actionable); In re iPhone Application Litig., No. 11-MD-02250-LHK, 82011 WL 4403963
, at *13–14 (N.D. Cal. Sept. 20, 2011 (following Hamidi and dismissing a 9 privacy-based action where plaintiffs failed to connect the trespass to a harm in the functioning of 10 the phone). 11 Plaintiffs’ trespass claim is based on their assertions that Meta places the _fbp cookie on 12 their devices via their health-care providers’ websites. They do not allege that the presence of that 13 cookie “impairs” the operation of their devices in terms of diminished storage, decreased battery 14 life, or otherwise. Instead, they assert that Meta’s tracking diminishes the value of plaintiffs’ 15 computing devices because plaintiffs no longer want to use their devices to communicate with 16 their healthcare providers. CCAC ¶¶ 415-28, 423-25. They analogize their inability to use their 17 phones and computers to communicate with their healthcare providers (lest they disclose personal 18 healthcare information) to the situation in Grace v. Apple Inc., No. 17-CV-00551,2017 WL 19
3232464, at *11 (N.D. Cal. July 28, 2017). There, based on allegations that Apple heavily 20 advertised the presence and ability to use Facetime in its iPhones and allegations that use of 21 Facetime was integral to the plaintiffs’ use of their iPhones, the court allowed the trespass claim to 22 continue because the removal of Facetime from plaintiffs’ phones due to Apple’s software update 23 significantly impaired the value of plaintiffs’ phones. 24 Here, unlike in Grace, there are no allegations that any functionality inherent in their 25 computing devices has been impacted by Meta’s conduct. Nor are there allegations that plaintiffs 26 purchased any specific computing device with the purpose in whole or part of using that device to 27 communicate with their healthcare providers. That these plaintiffs may have valued using their 1 value of those devices to allow the plaintiffs to state a trespass to chattels claim. 2 The trespass claim is DISMISSED with leave to amend. 3 IX. LARCENY – CLAIM 11 4 Plaintiffs’ larceny claim is brought under California Penal Code sections 484 and 496(a),12 5 based on the theory that Meta “knowingly obtained” plaintiffs’ information “by false pretenses.” 6 CCAC ¶¶ 455-464; Oppo. at 20-21; see also Bell v. Feibush,212 Cal. App. 4th 1041
, 1047-48 7 (2013) (discussing theft by false pretenses). To plausibly state a theft by false pretenses claim, 8 plaintiffs must allege not only that Meta made specific false representations to them, but also that 9 plaintiffs transferred their property to Meta “in reliance on the representation.” See People v. 10 Miller,81 Cal. App. 4th 1427, 1440
(2000), as modified on denial of reh'g (July 6, 2000).
11 Plaintiffs have not clearly identified the specific representations that Meta made to them that
12 support their larceny claim or the facts showing that their reliance on those representations
13 issufficient to state this claim.
14 The larceny claim is DISMISSED with leave to amend.
15 X. UNFAIR COMPETITION LAW (CLAIM 9) AND CONSUMERS LEGAL
RREMEDIES ACT (CLAIM 10)
16
A UCL claim may only be brought by “a person who has suffered injury in fact and has
17
lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204
.
18
Plaintiffs, therefore, must “demonstrate some form of economic injury,” such as surrendering
19
more or acquiring less in a transaction, having a present or future property interest diminished,
20
being deprived of money or property, or entering into a transaction costing money or property that
21
would otherwise have been unnecessary. Kwikset Corp. v. Superior Court, 51 Cal. 4th 310
, 323
22
(2011).
23
Courts in this district have dismissed cases where, like here, the injury is based on “the loss
24
of the inherent value of their personal data,” see Cottle v. Plaid Inc., 536 F. Supp. 3d 461
, 484
25
(N.D. Cal. 2021), as well as where it was undisputed that plaintiffs paid no money to the
26
27
12 California Penal Code section 484 forbids theft, which includes obtaining property “by ... false
1 defendant. See In re Facebook, Inc., Consumer Privacy, 402 F. Supp. 3d at 804 (noting “the
2 plaintiffs here do not allege that they paid any premiums (or any money at all) to Facebook to
3 potentially give rise to standing under California law” for purposes of UCL claim and dismissing
4 claim for failure to allege “lost money or property”); Wesch v. Yodlee, Inc., No. 20-cv-05991-SK,
5 2021 WL 1399291
, at *6 (N.D. Cal. Feb. 16, 2021) (holding that the plaintiffs had not alleged that 6 they “surrender[ed] more or acquir[ed] less in a transaction than they otherwise would have” for 7 purposes of UCL standing where they had not paid money to the defendant). 8 Plaintiffs rely on In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., 6139 F. Supp. 3d 1284, 1301
(S.D. Cal. 2020). But the injury in that case was based on a “benefit-of- 10 the-bargain” theory that plaintiffs “acquired less” in their transactions with the defendant (who 11 sold medical devices to plaintiffs). See also Cappello v. Walmart Inc.,394 F. Supp. 3d 1015
,
12 1019 (N.D. Cal. 2019) (benefit-of-the-bargain theory asserted by customers of defendant). There
13 is no benefit of the bargain basis alleged in the CCAC with respect to the UCL claim, although
14 benefit of the bargain allegations are made in support of the contract claim. See CCAC ¶ 316
15 (seeking benefit of the bargain contract damages). Given the different requirements to state a
16 plausible remedy under a breach of contract claim and “loss of money or property” under the
17 UCL, a cognizable “benefit of the bargain” theory has not adequately been alleged as a remedy for
18 the UCL claim.13
19 With respect to diminished value of their data, in the most recent Northern District case to
20 address the issue the Hon. Richard S. Seeborg reviewed recent cases and held:
21 Plaintiffs fail to show they have an economic injury. Plaintiffs do
identify some support for the idea that personal information without
22 consent constitutes economic injury. See Calhoun v. Google LLC, 526 F. Supp. 3d 605
, 636 (N.D. Cal. 2021) (“[T]he Ninth Circuit and a
23 number of district courts, including this Court, have concluded that
plaintiffs who suffered a loss of their personal information suffered
24 economic injury and had standing.”) (citing cases, including In re
Facebook Privacy Litig. (“Facebook Privacy”), 572 F. App'x 494
,
25 494 (9th Cir. 2014); and In re Yahoo! Inc. Cust. Data Sec. Breach
26
13 Plaintiffs also rely on Callahan v. PeopleConnect, Inc., No. 20-CV-09203-EMC, 2021 WL 27
5050079, at *19 (N.D. Cal. Nov. 1, 2021), motion to certify appeal denied, No. 20-CV-09203-
Litig., No. 16-MD-02752-LHK, 2017 WL 3727318
, at *13 (N.D. Cal.
1 Aug. 30, 2017)). The weight of the authority in the district and the
state, however, point in the opposite direction: that “the ‘mere
2 misappropriation of personal information’ does not establish
compensable damages.” Pruchnicki v. Envision Healthcare Corp.,
3 845 F. App'x 613
, 615 (9th Cir. 2021) [citations omitted]. Because
Plaintiffs have not alleged a specific monetary or economic loss,
4 Plaintiffs lack standing to maintain their UCL claims.
5 Katz-Lacabe v. Oracle Am., Inc., No. 22-CV-04792-RS, 2023 WL 2838118
, at *8 (N.D. Cal. Apr. 6 6, 2023). 7 Judge Seeborg relied in part on Moore v. Centrelake Med. Grp., Inc.,83 Cal. App. 5th 515
, 8 538 (2022), review denied (Dec. 14, 2022). There, the California Court of Appeal held that 9 plaintiffs’ “lost-value-of-PII theory, as pled, is insufficient to support UCL standing,” because 10 “[a]ppellants properly pled only that their PII was stolen and disseminated, and that a market for it 11 existed. They did not allege they ever attempted or intended to participate in this market, or 12 otherwise to derive economic value from their PII. Nor did they allege that any prospective 13 purchaser of their PII might learn that their PII had been stolen in this data breach and, as a result, 14 refuse to enter into a transaction with them, or insist on less favorable terms. In the absence of any 15 such allegation, appellants failed to adequately plead that they lost money or property in the form 16 of the value of their PII.” Id. at 538. 17 Plaintiffs rely on Brown v. Google LLC, No. 20-CV-03664-LHK,2021 WL 6064009
(N.D. 18 Cal. Dec. 22, 2021). There, the Honorable Lucy H. Koh found that plaintiffs adequately alleged 19 lost money or property sufficient to state their UCL claim where they alleged that “because 20 Google previously has paid individuals for browsing histories, it is plausible that, had Plaintiffs 21 been aware of Google’s data collection, they would have demanded payment for their data. Thus, 22 by inducing Plaintiffs to give Google their data without payment, Google caused Plaintiffs to 23 ‘acquire in a transaction less[ ] than [they] otherwise would have.’ [] Second, because there are 24 several browsers and platforms willing to pay individuals for data, it is plausible that Plaintiffs 25 will decide to sell their data at some point. Indeed, each named Plaintiff has alleged that he or she 26 is aware of these browsers and platforms. [] Accordingly, by obtaining Plaintiffs’ data and selling 27 it to advertisers, Google ‘diminished’ Plaintiffs’ ‘future property interest.’ Kwikset,51 Cal. 4th at 1
Here, plaintiffs contend their allegations bring them closer to Brown and satisfy the 2 deficiencies identified in Moore. See CCAC ¶¶ 22 (alleging Meta “takes patients’ property and 3 property rights without compensation and ignores their right to control the dissemination of their 4 health information to third parties”), 215 (“Meta itself has paid users for their digital 5 information”). But the crux of this case concerns Meta’s receipt of “individually identifiable 6 health information,” that plaintiffs apparently do not want Meta or anyone other than their 7 healthcare providers to have. Id., ¶¶ 1, 216 (“Americans typically do not want to see their 8 individually identifiable health information for any purpose”). That brings it closer to Moore and 9 Katz-Lacabe. 10 In light of the failure to separately allege a benefit of the bargain basis for “loss of money 11 or property” under the UCL and in light of the inconsistent allegations regarding how plaintiffs 12 could and would participate in a legitimate market for health care information, the UCL claim is 13 DISMISSED with leave to amend. 14 There is a different deficiency with plaintiffs’ claim under the CLRA. The CLRA claim is 15 based on Meta’s representation “that it required its Partners to have the right to collect, use and 16 share Plaintiffs’ and Class members’ information but doing nothing to ensure their rights were 17 protected.” CCAC ¶¶ 451-453. As a result, plaintiffs allege that Meta violated section 1770(2) of 18 the CLRA by “[m]isrepresenting the source, sponsorship, approval, or certification of goods or 19 services”; section 1770(5) of the CLRA by “[r]epresenting that goods or services have 20 sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities which they do not 21 have”; and section 1770(14) of the CLRA by “[r]epresenting that a transaction confers or involves 22 rights, remedies, or obligations which it does not have or involve, or which are prohibited by law.” 23 Meta moves to dismiss these misrepresentations claims under Rule 9(b) because none of 24 the plaintiffs allege that they saw and relied on those alleged misrepresentations. See, e.g., In re 25 Zoom Video Commc'ns Inc. Priv. Litig.,525 F. Supp. 3d 1017
, 1046 (N.D. Cal. 2021) (dismissing
26 CLRA claims where “[n]o Plaintiff alleges reading those allegedly misleading statements, let
27 alone reading them at a specific time or place.”). Plaintiffs did not address this issue in their
1 DISMISSED with leave to amend so that plaintiffs can plead facts regarding reliance on the
2 || alleged misrepresentations.'4
3 CONCLUSION
4 For the foregoing reasons Meta’s motion is DENIED regarding the ECPA, CIPA, breach
5 || of contract, and unjust enrichment claims. The motion is GRANTED with leave to amend on the
6 || privacy, CDAFA, negligence per se, trespass, larceny, UCL, and CLRA claims. Plaintiffs shall
7 file their amended complaint within twenty (20) days of the date of this Order.
8
9 Dated: September 7, 2023
10 : \f
11 ®
Wilfiam H. Orrick
12 United States District Judge
15
16
= 17
Z 18
19
20
21
22
23
24
25
26 4 Th my Tentative Order issued in advance of the hearing, I indicated I was inclined to follow
Judge Koh’s decision in Calhoun v. Google LLC, 526 F. Supp. 3d 605
, 635 (N.D. Cal. 2021).
07 Dkt. No. 298. However, the defendant in Calhoun moved to dismiss arguing only that there was
no property interest in browsing data and that copying data did not amount theft. Jd. Meta’s
2g || argument here rests on plaintiffs’ failure to satisfy the false statement and reliance elements of that
claim.