684 F.Supp.3d 1024
S.D. Cal.2023Background
- Defendant Kochava provides an SDK embedded in third‑party mobile apps that collects device identifiers, geolocation and in‑app activity, then packages and sells that data to clients for advertising/analytics.
- Plaintiff Greenley, a California resident, alleges Kochava’s SDK surreptitiously intercepted his phone’s location and communications (including visits to "sensitive locations") without his consent and sold the data; Kochava announced a limited "Privacy Block" for health‑care locations after FTC scrutiny.
- Procedural posture: Greenley filed a putative California class action alleging violations of the California Constitution (privacy), CDAFA, CIPA (multiple sections), UCL, and unjust enrichment; Kochava moved to dismiss for lack of standing and for failure to state claims (Fed. R. Civ. P. 12(b)(1),(6)) and separately moved to transfer venue to the District of Idaho (28 U.S.C. § 1404(a)).
- The Court denied the Rule 12(b)(1) standing challenge, finding Greenley plausibly alleged concrete privacy injuries traceable to Kochava and redressable by relief.
- The Court denied Kochava’s transfer motion: plaintiff’s forum choice, California’s strong local interest in consumer privacy, and the Southern District’s familiarity with California law outweighed judicial‑economy considerations favoring consolidation in Idaho.
- On Rule 12(b)(6) review the Court: sustained (dismissed) CIPA § 632 and Greenley’s UCL and unjust enrichment claims (with leave to amend); but denied dismissal for invasion of privacy (Cal. Const.), CDAFA, CIPA § 638.51 (pen‑register theory), and CIPA § 631 (wiretapping clause).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing (Article III) | Greenley: secret collection/disclosure of private, sensitive location and in‑app data is a concrete privacy injury and confers standing. | Kochava: complaint lacks a particularized injury, no economic loss, and consent/opt‑out defeats injury. | Denied dismissal: court finds concrete, particularized injury plausible; causation and redressability met; consent and economic‑value arguments rejected at pleading stage. |
| Venue transfer (§ 1404(a)) | Greenley: California is appropriate forum; local interests and familiarity with California law weigh against transfer. | Kochava: principal place of business is Idaho; related suits (including FTC and an Idaho/Washington class action) favor consolidation in Idaho. | Denied: plaintiff's forum choice, California's strong interest and court's familiarity with state law outweigh consolidation benefits. |
| Invasion of privacy (Cal. Const./common law) | Greenley: surreptitious fingerprinting and correlation of detailed location and activity data is an egregious intrusion. | Kochava: allegations insufficiently serious to show an egregious breach of privacy norms. | Denied dismissal: allegations plausibly state an egregious privacy invasion; fact question for later stages. |
| CDAFA (Cal. Penal Code § 502) | Greenley: Kochava knowingly accessed/took computer data without permission via hidden SDK; no valid consent. | Kochava: users consented via app permissions/disclosures; "without permission" requires circumvention/hacking. | Denied dismissal: consent not plausibly established; "without permission" read broadly (and alleged circumvention of Apple ATT), claim survives. |
| CIPA (pen register § 638.51; wiretap § 631; eavesdrop § 632) | Greenley: SDK can function as a pen‑register/process (§ 638.51); collected contents/search terms (§ 631); also recorded communications (§ 632). | Kochava: SDK is not a pen register; data collected are not "contents"; no confidential communications for § 632. | Mixed: § 638.51 and § 631 claims survive (court accepts software/process as pen‑register and finds contents allegations plausible); § 632 claim dismissed for failure to allege objectively reasonable expectation of confidentiality (leave to amend). |
| UCL / Unjust enrichment | Greenley: unfair business practices and unjustly retained profits from selling users’ data; seeks restitution and injunctive relief. | Kochava: Greenley fails to allege economic injury/loss of money or property necessary for UCL standing; unjust enrichment is not a standalone claim. | Dismissed: UCL claims lack alleged economic loss tied to plaintiff (leave to amend); unjust enrichment dismissed as not a standalone cause. |
Key Cases Cited
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (recognizing requirement of a concrete, particularized injury for Article III standing)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (pleading standard for Article III injury and need to allege concrete harm)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing elements: injury, causation, redressability)
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir.) (collection/disclosure of browsing/location data can constitute concrete privacy injury)
- Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir.) (privacy right roots and analysis of modern digital intrusions)
- In re Zynga Privacy Litig., 750 F.3d 1098 (9th Cir.) (discussion of pen‑register/ Fourth Amendment context)
- United States v. Forrester, 512 F.3d 500 (9th Cir.) (no expectation of privacy in certain internet routing/addressing metadata)
- Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22 (forum non conveniens/convenience analysis under § 1404(a))
- Daimler AG v. Bauman, 571 U.S. 117 (general jurisdiction principles)
- Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., 528 U.S. 167 (voluntary cessation doctrine does not automatically moot claims)
- Cel‑Tech Commc'ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal.4th 163 (scope and remedial purpose of California's UCL)
- Brown v. Google LLC, 525 F. Supp. 3d 1049 (N.D. Cal.) (privacy expectations and economic‑injury discussion in browser/incognito context)