723 F.Supp.3d 934
S.D. Cal.2024Background
- Miguel Esparza, a California resident, used Kohl’s website chat feature and alleges that his chat communications were intercepted and personal information was improperly collected, de-anonymized, and shared with third-party companies.
- Esparza claims Kohl’s allowed Ada Support, Inc. (ASI) to embed its software on the website, which enabled eavesdropping and persistent cookies that tracked users and built extensive marketing databases.
- Plaintiff brought a putative class action with claims under the California Invasion of Privacy Act (CIPA), California Computer Data Access and Fraud Act (CDAFA), the California Constitution, and common law intrusion upon seclusion.
- Kohl’s filed a motion to dismiss all claims pursuant to Rule 12(b)(6), arguing insufficiency of factual allegations and various legal exemptions.
- The Court granted in part and denied in part Kohl’s motion, permitting the CIPA and CDAFA claims to proceed but dismissing the invasion of privacy and intrusion claims with leave to amend.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| CIPA (Section 631(a))—Consent | No express or implied consent given for interception | Written chats are inherently recorded; thus, consent given | Plaintiff sufficiently alleged lack of consent |
| CIPA—Party Exemption for ASI | ASI goes beyond mere recording; acts as a third-party | ASI is just a recording tool, thus exempt as a party | Factual issue; cannot dismiss at motion stage |
| CIPA—Content Requirement | ASI intercepted and stored chat content | Plaintiff failed to allege specific contents of communications | Allegations sufficient at pleading stage |
| CIPA—In Transit Requirement | Data intercepted real-time via ASI’s servers | Timing of interception not alleged | Plaintiff sufficiently alleged real-time interception |
| CIPA—Use of Information (Clause Three) | ASI/Kohl’s profited from using personal data | No plausible allegation of use for benefit | Plaintiff plausibly alleged use by ASI |
| CDAFA—Without Permission & Loss | ASI's software acted without technical circumvention; loss is misappropriated data’s value | Device barriers not breached; no cognizable loss | "Without permission" broad, economic injury plausible |
| CA Const./Intrusion Upon Seclusion | Personal details and browsing history secretly gathered | No access to sensitive data, no highly offensive conduct | Dismissed for insufficiently alleging sensitive harm |
Key Cases Cited
- Navarro v. Block, 250 F.3d 729 (9th Cir. 2001) (sets out standard for Fed. R. Civ. P. 12(b)(6) motion to dismiss)
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (pleading standard for plausibility)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) (pleading standard for plausibility)
- Tavernetti v. Superior Ct., 22 Cal. 3d 187 (Cal. 1978) (interprets operative clauses of CIPA Section 631(a))
- Warden v. Kahn, 99 Cal. App. 3d 805 (Cal. Ct. App. 1979) (party exemption for CIPA eavesdropping)
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (party exemption to CIPA liability and expectations of privacy under state law)
- Hernandez v. Hillsides, Inc., 47 Cal. 4th 272 (Cal. 2009) (elements for common law intrusion upon seclusion and constitutional privacy)
- Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1 (Cal. 1994) (standard for protected privacy interests)
- In re Vizio, Inc. Consumer Priv. Litig., 238 F. Supp. 3d 1204 (C.D. Cal. 2017) (expectation of privacy and highly offensive intrusion analyzed for browsing data)