MARIE HAMMERLING, et al., Plaintiffs, v. GOOGLE LLC, Defendant.
Case No. 21-cv-09004-CRB
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA
Filed 07/18/22
Case 3:21-cv-09004-CRB Document 50 Page 1 of 32
Plaintiffs Marie Hammerling and Kay Jackson allege that for years Defendant Google LLC secretly used their Android smartphones to collect data about non-Google app installation metrics, the amount of time spent using non-Google apps, and how often those apps were open. Plaintiffs allege that Google used this data determine Plaintiffs’ personal information, such as their religious and political beliefs. In doing so, Google allegedly breached its contract with its customers and violated California’s Unfair Competition Law, the California Constitution, and California fraud and privacy laws. Compl. (dkt. 1) ¶¶ 1, 10. Google moves to dismiss Plaintiffs’ claims for failure to state a claim under
I. BACKGROUND
A. Parties
Hammerling and Jackson are Florida residents who bring this putative class action on behalf of themselves, and all others similarly situated. Compl. ¶¶ 15, 19, 86. Since 2014, Plaintiffs have owned several Android smartphones, all made by manufacturers other than Google itself. Id. ¶¶ 15, 19. Android OS is an operating system that powers
B. The Complaint
Plaintiffs allege the following. Since 2012, Google has collected “sensitive personal data” from Android smartphones through a secret project titled, “Android Lockbox.” Id. ¶¶ 35, 38. The public first learned of Google’s “Android Lockbox” project in 2020, when the news service, The Information, published an article detailing the project. Id. ¶¶ 44, 83. A congressional report released after The Information’s article described Google’s “Android Lockbox” as “a covert effort to track real-time data” on Android smartphone users’ “usage and engagement” with non-Google apps. Id. ¶ 34. The report detailed that “usage and engagement” data (what Plaintiffs call “sensitive personal data”) includes “installation metrics” for non-Google apps, “the average number of days users were active on any particular app,” and a users’ total time spent on a non-Google app.1 Id. ¶¶ 34-35, 37-38, 121.
Plaintiffs allege that Google utilized “Android Lockbox” to collect Plaintiffs’ personal data without their knowledge or consent. Id. ¶¶ 17, 21, 48. Plaintiffs use several non-Google apps on their smartphones, “including Facebook, Instagram, and TikTok.” Id. ¶¶ 16, 20. Google allegedly collected usage and engagement data from these non-Google apps and then used the data to compete with rivals like Facebook. Id. ¶¶ 39, 41. Plaintiffs also allege that from the data Google can learn intimate details about users, such as “their religious and political affiliations, their activity level, their sexual preferences and proclivities, and other habits and preferences.” Id. ¶ 69. For example, “Google can learn details of a user’s sleep schedule, menstrual cycle, or exercise routine based on when and how often they interact with an alarm clock app, fertility tracker, or fitness app.”2 Id. ¶ 7.
Plaintiffs allege Google does not seek consent to collect Android user data from non-Google apps. Id. ¶ 46. Further, it does not disclose that it collects this data or that it does so to compete with other companies. Id. ¶¶ 46–47. Rather, when Plaintiffs and class members set up their Android smartphones for the first time, Google states only that it collects user data “to offer a more personalized experience.” Id. ¶ 52. Google’s Privacy Policy similarly does not disclose Google’s data collection practices. Id. ¶ 55. Google’s Privacy Policy “only states that it may collect information about ‘activity on third-party sites and apps that use our services,’” but it does not explain that it monitors the “frequency that non-Google apps are used or the duration of time a user spends on non-Google apps.” Id. ¶ 58. Plaintiffs allege that they “would not have purchased, or would have paid significantly less for,” their Android Smartphones had they known that Google would collect their personal data from non-Google apps. Id. ¶ 61.
Based on these allegations, Plaintiffs allege the following ten claims: (1) common law intrusion upon seclusion; (2) invasion of privacy under the California Constitution; (3) violation of
C. McCoy v. Alphabet
In their papers, both parties refer to a recent decision by Judge van Keulen that concerned issues nearly identical to those in this case. The McCoy v. Alphabet plaintiffs (represented by the same attorneys as here) sued Google for collecting their personal data from non-Google apps on Android smartphones. 2021 WL 405816, at *1 (N.D. Cal. Feb. 2, 2021). The McCoy plaintiffs alleged the same ten claims present here. Id. at *4. Judge
Where applicable, the Court refers to Judge van Keulen’s reasoning in McCoy in this order. Judge van Keulen, however, did not consider (or the parties did not present to her) many of the arguments Plaintiffs assert in this case.
II. LEGAL STANDARD
Under
Claims for fraud must meet the pleading standard of
If a court dismisses a complaint for failure to state a claim, it should “freely give leave” to amend “when justice so requires.”
III. DISCUSSION
This order first considers whether Google’s Privacy Policy is incorporated by reference into the complaint. It then addresses Google’s motion to dismiss in the following order: (1) fraud claims (Section 1709, UCL’s fraud prong, and CLRA); (2) privacy claims (common law intrusion upon seclusion, invasion of privacy under the California Constitution, and CIPA); (3) UCL’s unlawful and unfair prongs; (4) contract claims (breach of contract, implied contract, and unjust enrichment); and (5) declaratory
A. Incorporation by Reference
Google requests that the Court take judicial notice or incorporate by reference two versions of its Privacy Policy (“Policy”). RJN at 2; Kanig Decl. (dkt. 33-1) at 1, Ex. A, Ex. B. Exhibit A is the Policy that was effective on December 19, 2019, and Exhibit B is the Policy that was effective on July 1, 2020. Kanig Decl. at 1.
The incorporation-by-reference doctrine “treats certain documents as though they are part of the complaint itself.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Documents are subject to incorporation by reference if a plaintiff refers to them “extensively” or they form the basis of the complaint. Id. Courts may properly assume the truth of documents incorporated by reference. Id. at 1003. But “it is improper to assume the truth of an incorporated document if such assumptions only serve to dispute facts stated in a well-pleaded complaint.” Id.
The complaint incorporates by reference both versions of Google’s Privacy Policy. Plaintiffs cite extensively to the Policy, and it forms the basis of their fraud and contract claims. See Compl. ¶¶ 129-31, 163; Khoja, 899 F.3d at 1002. Plaintiffs refer to the two versions of Google’s Privacy Policy nearly twenty times in their Complaint. See Compl. ¶¶ 55-60, 80, 129-130, 131, 160, 162-163, 165, 170, 173-74, 177-78, & nn. 2, 9, 10, 12; Khoja, 899 F.3d at 1003-04 (incorporating by reference a blog post cited and quoted once in a complaint). Because these documents are incorporated by reference, the Court need not consider whether it may also take judicial notice of them.
B. Fraud Claims (claims 3, 4, and 5)
Plaintiffs allege violations of the CLRA, UCL’s fraud prong, and
To allege a violation of the three statutes based on a fraudulent misrepresentation or omission, a plaintiff must plead (1) misrepresentation or omission, (2) reliance, and (3) damages. Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 326 (2011) (CLRA and UCL); Mirkin v. Wasserman, 5 Cal. 4th 1082, 1091 (1993) (deceit).3 Additionally, a plaintiff must plead all three claims with particularity as required by
Plaintiffs allege that Google committed both fraudulent misrepresentation and omission. See Compl. ¶¶ 51-54 (fraudulent misrepresentation), 55-61 (fraudulent omission); Mot. at 7; Opp’n at 6. As to misrepresentation, Plaintiffs allege that when they set up their Android smartphones, Google falsely told Plaintiffs that it would collect their personal data “to offer a more personalized experience.” Id. ¶¶ 51-52, 54, 129-130. But Google’s actual reason for collecting such data is “to gain an unfair competitive edge over its competitors.” Id. ¶¶ 54, 129. As for their fraudulent omission theory, Plaintiffs allege that Google fails to disclose (1) that it collects personal data when Android users interact with non-Google apps and (2) uses such data to compete with other companies. Id. ¶ 55. Had Plaintiffs known that Google would collect their personal data from non-Google apps, they would not have purchased, or would have paid significantly less for, their Android smartphones. Compl. ¶¶ 18, 22, 49, 61, 135, 146, 152.
As explained below, the Court dismisses the fraud claims. As a preliminary matter, the Court agrees that Plaintiffs have plausibly pleaded that the Privacy Policy failed to disclose material information regarding Google’s data collection practices. However, the fraudulent misrepresentation claims fail because Plaintiffs do not plausibly plead reliance
1. Disclosure
First, the Court disagrees with Google that its Policy discloses what Plaintiffs allege it misrepresents and omits: that it collects data from non-Google apps and uses that data to compete with other companies. See Mot. at 8.
To state a fraudulent omission or misrepresentation claim under Section 1709, a plaintiff must plead either a false representation, concealment, or nondisclosure. Lazar, 12 Cal. 4th at 638. Nondisclosure and concealment mean the “suppression of a fact, by one . . . who gives information of other facts which are likely to mislead for want of communication of that fact.”4
Under Section 1709, the UCL, or the CLRA, when a defendant truthfully and clearly discloses an alleged misrepresentation or omission, a plaintiff cannot plausibly state
Here, Google argues that six disparate portions of its Privacy Policy together amount to a disclosure that it collects user data from non-Google apps on Android smartphones and uses the data to compete with other companies. See Mot. at 8-10. First, Google states on page one of its Policy that Android OS is a Google service. See Mot. at 9; Kanig Decl. Ex. A at 1 (“Our services include: . . . Platforms like the Chrome browser and Android operating system”). Second, page three of the Policy states that Google collects information regarding apps that a user has installed. See Mot. at 8; Kanig Decl. Ex. A at 3 (“We collect information about the apps, browsers, and devices you use to access Google services. . .”). Third, also on page three, the Policy states that Google collects information about a user’s activity on their services, including “[a]ctivity on third party sites and apps that use our services.” See Mot. at 8; Kanig Decl. Ex. A at 3. Fourth, on page five, the Policy states that Google uses the information it collects to improve and develop new services. Reply at 7; Kanig Decl. Ex. A at 6 (“And we use your information to make improvements to our services”); id. (“We use the information we collect in existing services to help us develop new ones.”). Fifth, page seventeen of the Policy states that Google “uses information to improve our services and to develop new products, features, and technologies that benefit our users and the public.” See Mot. at 9; Kanig Decl. Ex. A at 16, Ex. B at 17. This section appears under the heading “California Requirements” and (in the 2020 version of the Policy) under the subheading “Business purposes for which information may be used or disclosed.” Sixth, page eighteen of the
From these six portions of its Privacy Policy, Google asserts that a reasonable consumer must conclude that because the Policy states that Android OS is a Google service, all apps on an Android smartphone (including non-Google apps) are using a Google service. See Mot. at 8-9. Thus, in stating that it collects data from apps that use Google services, Google argues that it discloses that it collects data from non-Google apps on Android smartphones. See id. By disclosing its collection of user data from non-Google apps, Google argues that it also discloses that it uses such data to develop new products and compete with other companies. See id. at 9. Because Google discloses these facts, Google argues that Plaintiffs cannot allege fraudulent omission or misrepresentation. See id. at 8-10.
But it is at least as plausible that a reasonable consumer would read Google’s Privacy Policy and reach a different conclusion. Plaintiffs argue that they could conclude that Google collects user data only from Google apps (i.e., Gmail, Photos, or Google Maps) and not non-Google apps. See Opp’n at 3-4. For example, a consumer could read the statement that Google collects a user’s “[a]ctivity on third party sites and apps that use our services” to mean that Google collects data only from apps “that require users to sign into Google services, like YouTube [or Gmail].” See Kanig Decl. Ex. A at 3; Opp’n at 4 (emphasis added). To conclude that “apps that use our services” includes all non-Google apps, a consumer would have to realize that, somewhat counterintuitively, every single app could be construed as an “app[] that use[s] our services” because page one of the Policy defines Google’s services to include the operating system itself. At the motion to dismiss stage, the Court does not decide the factual question of which interpretation is more likely.
The Court rejects Google’s argument and finds it plausible that Google did not adequately disclose its data collection practices. See Dinan, 2019 WL 2327923, at *2.
2. Misrepresentation
However, the Court dismisses the fraudulent misrepresentation claims because Plaintiffs fail to allege that they relied on any misrepresentation.
To plausibly allege a CLRA, UCL, or Section 1709 claim, a plaintiff must allege that they relied on a misrepresentation and suffered injury as a result. See Moore v. Apple, Inc., 73 F. Supp. 3d 1191, 1200 (N.D. Cal. 2014); Mirkin, 5 Cal. 4th at 1092. But, here, Plaintiffs only allege that they “relied upon [Google’s] statement when setting up their Android Smartphones.” Compl. ¶ 52. Critically, they do not allege whether this occurred before or after their purchases. See Davidson v. Apple, Inc., 2017 WL 976048, at *8 (N.D. Cal. Mar. 14, 2017) (holding that the plaintiffs failed to plead actual reliance because their complaint was “devoid of allegations that [they] were exposed to any representation . . . prior to purchasing an iPhone 6 or 6 Plus” (emphasis in original)); Donohue v. Apple, Inc., 871 F. Supp. 2d 913, 925 (N.D. Cal. 2012) (holding that the plaintiff failed to plead actual reliance because he did not “allege that he relied on the [misrepresentation] in making his purchase”). Plaintiffs have, therefore, failed to allege that they relied on Google’s alleged misrepresentation before purchasing their Android smartphones. See Swartz, 476 F.3d at 764.
Plaintiffs’ three arguments in response are unpersuasive. First, Plaintiffs argue that Judge van Keulen rejected the same argument that Google makes here in McCoy. See Opp’n at 11. But it is unclear if Judge van Keulen considered the timing of the plaintiff’s purchase in McCoy, and in any case, this Court is not bound by McCoy. Second, Plaintiffs argue that actual reliance can occur after purchase but before a plaintiff uses and sets up
Therefore, by not alleging that they relied on Google’s misrepresentation before purchasing their Android Smartphones, Plaintiffs fail to plausibly allege actual reliance with particularity. See Swartz, 476 F.3d at 764. Accordingly, the Court dismisses Plaintiffs’ fraud claims to the extent that they rely on a misrepresentation theory.
3. Omission
The fraudulent omission claims fail because Plaintiffs do not allege that Google had a duty to disclose the omitted information.
To plausibly allege a fraudulent omission, the omission must either (1) “be contrary to a representation actually made by the defendant,” or (2) “an omission of a fact the defendant was obliged to disclose.”7 Anderson v. Apple Inc., 500 F. Supp. 3d 993, 1012
Courts have noted that the law concerning a defendant’s duty to disclose in a fraudulent omissions case is “marked by general disarray.” In re Toyota RAV4 Hybrid Fuel Tank Litig., 534 F. Supp. 3d 1067, 1101 (N.D. Cal. 2021). The disarray stems in part from the fact that there are (at least) two different tests to determine whether a defendant has a duty to disclose. See id. at 1102 (noting the confusion). Under one approach, a defendant only has a duty to disclose when either (1) the defect at issue relates to an unreasonable safety hazard or (2) the defect is material, “central to the product’s function,” and the plaintiff alleges one of the four LiMandri factors. Id. The LiMandri factors are: (1) the defendant is in a fiduciary relationship with the plaintiff; (2) the defendant had exclusive knowledge of material facts not known to the plaintiff; (3) the defendant actively conceals a material fact from the plaintiff; or (4) the defendant makes partial representations but also suppresses some material facts. LiMandri v. Judkins, 52 Cal. App. 4th 326, 336 (1997). Under a separate approach, a defendant has a duty to disclose any time that a plaintiff alleges one of the following: (1) the defect relates to an unreasonable safety hazard; (2) the defect is material and related to the product’s central function; or (3) the presence of one of the four LiMandri factors. In re Toyota, 534 F. Supp. 3d at 1102.
Google argues for the first approach, see Mot. at 14-16, while Plaintiffs argue for the second, see Opp’n at 7-8. Plaintiffs point to In re Toyota RAV4 Hybrid Fuel Tank Litig., 534 F. Supp. 3d at 1101 and this Court’s decision in City & County of San Francisco v. Purdue Pharma L.P., 491 F. Supp. 3d 610, 690 (N.D. Cal. 2020). These two cases seemingly applied only the LiMandri factors to determine that the defendants there had a duty to disclose. See Purdue Pharma, 491 F. Supp. 3d at 690; In re Toyota, 534 F. Supp. 3d at 1101.
Applying the first approach, Plaintiffs must allege that Google’s collection of user data from non-Google apps on Android smartphones either (1) relates to an unreasonable safety hazard or (2) is material, “central to the product’s function,” and meets one of the four LiMandri factors. Hodsdon, 891 F.3d at 863. Plaintiffs do not argue, under the first prong, that Google’s alleged omission relates to an unreasonable safety hazard. Thus, they must plausibly allege the second prong. They have failed to do so because Google’s data collection practices are not central to the function of their Android smartphones. Plaintiffs argue that “[u]sing apps is at the heart of the smartphone experience” and thus affect a central function of the Android phone. Opp’n at 8-9 n.6. But that is not the test courts apply. The question is not whether a defect “affects” the product, rather the question is: does the alleged defect prevent the product from “performing a critical or integral function,” or render the product “incapable of use” for all users? See Knowles v. ARRIS Int’l PLC, 847 F. App’x 512, 513-14 (9th Cir. 2021) (critical and integral function); Ahern,
Plaintiffs have not alleged that Google’s collection of data from non-Google apps renders their smartphones “incapable of use” or prevents their phones from “performing a critical or integral function.” See Knowles, 847 F. App’x at 513-14; Ahern, 411 F. Supp. 3d at 567. Therefore, the Court dismisses Plaintiffs’ fraud claims to the extent Plaintiffs predicate them on a fraudulent omission theory because Plaintiffs fail to plausibly allege that Google had a duty to disclose.9
4. CLRA
Although the Court has already found that Plaintiffs have not stated any of their fraud claims, the Court also concludes that the CLRA claim also fails for another reason. The CLRA prohibits “unfair or deceptive acts or practices . . . undertaken by any person in a transaction . . . that results in the sale or lease of goods to any consumer.”
Google argues that Plaintiffs cannot state a claim under the CLRA because (1)
Google’s first argument is unpersuasive because Plaintiffs premise their CLRA claim on their purchase of Android smartphones, which are “goods” under the CLRA. The court in In re iPhone Application Litigation came to a similar conclusion. 844 F. Supp. 2d 1040, 1070-71 (N.D. Cal. 2012). There, plaintiffs sued Apple, asserting a CLRA claim premised on their purchase of “iDevices” (iPhones, iPods, iPads). Id. at 1048-49. The plaintiffs alleged Apple represented that it took “precautions” to protect consumers’ personal information. Id. at 1049-50. But contrary to Apple’s representations, plaintiffs alleged that when they downloaded free apps from Apple’s app store, app creators could access their personal information. Id. Apple argued that plaintiffs could not allege a CLRA claim based on downloading free apps. Id. at 1070. The court disagreed. Id. at 1070-71. It reasoned that the plaintiffs asserted a CLRA claim based on the purchase of their iDevices (and not the free apps) because they alleged that they overpaid for their iDevices due to Apple’s alleged false representations. Id. Plaintiffs here similarly allege that they overpaid for their Android smartphones because of Google’s failure to disclose its data collection practices. See Compl. ¶ 61. Thus, Plaintiffs sufficiently premise their CLRA claim on the sale of a good.
Nonetheless, Google is correct that Plaintiffs fail to allege a “transaction” under the CLRA. Although courts have held that the CLRA does not require a direct transaction between a plaintiff and a defendant, in cases where there was no direct sale, the plaintiff sued either (1) the manufacturer of the product or (2) a party that received some portion of the product’s sale. See, e.g., Philips v. Ford Motor Co., 2015 WL 4111448, at *14 (N.D. Cal. July 7, 2015) (holding that plaintiffs plausibly alleged a CLRA claim against the manufacturer of their cars despite not purchasing the car directly from the manufacturer); Decarlo v. Costco Wholesale Corp., 2020 WL 1332539, at *9 (S.D. Cal. Mar. 23, 2020) (holding that a plaintiff plausibly alleged a CLRA claim against Costco despite not
***
In sum, the fraud claims fail because (1) Plaintiffs did not actually rely on any alleged misrepresentation, and (2) Google lacked a duty to disclose any alleged omission. The CLRA claim fails for the additional reason that Plaintiffs fail to allege a “transaction.” The Court GRANTS the motion to dismiss the CLRA, UCL fraud prong, and Section 1709 claims.
C. Privacy Claims (claims 1, 2, and 10)
Plaintiffs allege three privacy claims: intrusion upon seclusion under California common law (claim 1), invasion of privacy under the California Constitution (claim 2), and violation of the CIPA (claim 10). Compl. ¶¶ 102-25, 196-201. The Court will address claims 1 and 2 together, and then address claim 10.
1. Privacy Under the Common Law and State Constitution
A claim for intrusion upon seclusion under California common law requires (1) intrusion into a private place, conversation, or matter to which Plaintiffs have a reasonable expectation of privacy (2) in a manner highly offensive to a reasonable person. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020) (citing Hernandez v. Hillside, 211 P.3d 1063, 1072 (Cal. 2009)). This District sets a high bar when assessing the “highly offensive” requirement. In re Google, Inc. Priv. Pol’y Litig., 58 F. Supp. 3d 968, 988 (N.D. Cal. 2014) (internal citation omitted). To state a claim for invasion of privacy under the California Constitution, Plaintiffs must show that (1) a legally protected privacy interest, (2) a reasonable expectation for privacy, and (3) the intrusion is so serious as to amount to an egregious breach of the social norms. Facebook Tracking, 956 F.3d at 601 (citing Hernandez, 211 P.3d at 287).
Given the similarity of the two tests, courts consider them together and ask (1) whether there is a reasonable expectation of privacy, and (2) whether the intrusion was highly offensive. See id. (citing Hernandez, 211 P.3d at 286). The Court concludes that these two privacy claims fail because, although Plaintiffs have pleaded a reasonable expectation of privacy, they have not pleaded that the intrusion was highly offensive.10
a. Reasonable Expectation of Privacy
Plaintiffs have plausibly pleaded that customers would reasonably expect Google not to track their usage data as to non-Google apps. A reasonable expectation of privacy can exist where a defendant gains “unwanted access to data by electronic or other covert means, in violation of the law or social norms.” See Facebook Tracking, 956 F.3d at 601-02 (quoting Hernandez, 211 P.3d at 286). Courts consider the customs, practices, and circumstances surrounding the data collection, including the amount of data collected, the sensitivity of data collected, the manner of data collection, and the defendant’s representations to its customers. See Hill v. National Collegiate Athletic Association, 865 P.2d 633, 655 (Cal. 1994).
In Facebook Tracking, the Ninth Circuit applied these factors to find that there was a reasonable expectation of privacy. 956 F.3d at 602-04. There, the plaintiffs alleged that Facebook obtained “an enormous amount of individualized data” by collecting URLs of third-party websites that could disclose the “search term” inputted by users which could potentially “divulge a user’s personal interests, queries, and habits on third-party websites operating outside of Facebook’s platform.” Id. at 603, 605. After noting the large amount and high sensitivity of the data collected, the court considered whether the manner of the data collection “violate[d] social norms.” Id. at 603. The court emphasized that the data
Conversely, there is no reasonable expectation of privacy when the data collection is within users’ common-sense expectation or when the information is not sensitive. For example, in United States v. Forrester, the Ninth Circuit held that internet users lacked a reasonable expectation of privacy in the IP addresses of the websites they visited because “they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” 512 F.3d 500, 510 (9th Cir. 2008). Likewise, in In re Zynga Privacy Litigation, the Ninth Circuit held that a user did not have a reasonable expectation of privacy in URLs that revealed only basic identification and address information. 750 F.3d 1098, 1108-09 (9th Cir. 2014). While both Zynga and Facebook Tracking concerned data collection of URLs, Zynga distinguished Facebook Tracking in two ways: first, where the URLs in Facebook Tracking disclosed the unique “search term” inputted by a user in a third-party search engine and the “particular document within a website that a person views,” the URLs in Zynga only revealed a user’s Facebook ID and the address of the Facebook webpage the user was viewing before the user clicked on a link to play a game. See 956 F.3d at 605 (citing Zynga, 750 F.3d at 1102). Second, the data collection in Zynga was less egregious because users there were still logged into their Facebook accounts, whereas the data collection in Facebook Tracking occurred after users logged out. See id. (citing Zynga, 750 F.3d at 1102).
Here, Plaintiffs have plausibly alleged a reasonable expectation of privacy because Google allegedly collected potentially sensitive data while users might not expect that Google was tracking them. Plaintiffs allege that Google collected usage data, including
Moreover, the manner of Google’s alleged data collection plausibly defies social norms. Plaintiffs allege that users were unaware of the data collection because Google used an “internal secret program” to collect data while users were not in Google apps. Compl. ¶ 4; Opp’n at 17. While Google never made affirmative promises not to collect the data as in Facebook Tracking, Google’s Privacy Policy is (at best) ambiguous. Calhoun reasoned that a reasonable expectation of privacy exists when the plaintiffs “could have reasonably assumed” the company’s policy prohibited data collection. 526 F. Supp. 3d at 630. So too here, because a reasonable consumer could have understood from the Terms of Service and Privacy Policy that Google collects data only from Google apps. See id.; see also McCoy, 2021 WL 405816, at *6 (finding that a reasonable user might understand the Privacy Policy to mean that Google would collect data from non-Google apps only to enhance the user’s personal experience). Because the collection of this large amount of personal information from users’ smartphones likely contravenes Plaintiffs’ reasonable understanding of the Privacy Policy, users had a reasonable expectation of privacy.
b. Highly Offensive
Nonetheless, these two privacy claims fail because Plaintiffs do not allege that Google’s intrusion was highly offensive. Determining whether a defendant’s actions were “highly offensive to a reasonable person” requires a “holistic consideration of factors such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the
Courts in this district have held that data collection and disclosure to third parties that is “routine commercial behavior” is not a “highly offensive” intrusion of privacy. See Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012) (LinkedIn‘s disclosure of users’ browser history to third parties was not highly offensive); Google Priv. Pol‘y, 58 F. Supp. 3d at 988 (Google‘s collection and disclosure of users’ browsing histories was not highly offensive); iPhone Application Litig., 844 F. Supp. 2d at 1063 (disclosures of unique device identification number, personal data, and geolocation information without consent were not an egregious breach of social norms). Even disclosure of highly personal information such as social security numbers is not “highly offensive.” Low, 900 F. Supp. 2d at 1025. But conduct is more likely to be “highly offensive” where the defendant “surreptitious[ly]” collects sensitive information even while the plaintiff has logged off and is not even using the defendant‘s services. See Facebook Tracking, 956 F.3d at 606 & n.8.
In McCoy, Judge van Keulen held that information of how long and how often users used non-Google apps “alone” could not rise to the standard of being “highly offensive.” 2021 WL 405816, at *8, *14. Google argues that Plaintiffs’ allegations in this case are “materially identical to” those dismissed in McCoy. Reply at 1. Plaintiffs insist that their allegations differ in two ways: (1) they allege details regarding the types of intimate personal information that Google can discern based on an individual‘s use of a certain apps, such as a user‘s sleep cycle, menstrual cycle, sexual preferences, religion, and political affiliations; (2) they plead information about the Congressional inquiry into Google‘s data collection practices and quote a House Subcommittee‘s conclusion that Google “collects specific usage data” that yields “near-perfect market intelligence.” Compl. ¶¶ 37-39; Opp‘n at 18-19.
But perhaps more importantly, Plaintiffs do not allege that the data allegedly collected by Google is sufficiently specific or personal, and its collection sufficiently harmful, to be highly offensive. Factors like “the likelihood of serious harm to the victim, the degree and setting of the intrusion, [or] the intruder‘s motives and objectives” do not plausibly suggest that Google‘s behavior was that egregious. See Facebook Tracking, 956 F.3d at 606. To be sure, information about a user‘s menstrual cycle is extremely intimate. But, without more, it is not plausible that Google can deduce a user‘s menstrual cycle just from knowing how long the user uses a fertility tracker app. Plaintiffs do not allege that Google collects specific menstrual cycle information inputted in the fertility tracker app.11 The lack of details as to how Google could attain the intimate information renders implausible what might otherwise be the strongest allegation of highly offensive conduct.
Nor is the other personal information allegedly collected by Google sufficiently intrusive to satisfy this element. Courts have found egregious intrusions of privacy in cases involving surreptitious recording of people‘s voices and conversations. See In re Google Assistant Privacy Litigation, 457 F. Supp. 3d 797, 830 (N.D. Cal. 2020) (finding
Because Plaintiffs have not alleged that Google‘s conduct is plausibly “highly offensive” or “egregious,” the common-law and constitutional privacy claims fail.
2. California Invasion of Privacy Act
The Court also concludes that the CIPA claim is insufficiently pleaded. CIPA prohibits any person from using electronic means to “learn the contents or meaning of any message, report, or communication” “without the consent of all parties to the communication.”
As noted above, Google plausibly lacked consent from Plaintiffs as to its data collection. The questions are whether Plaintiffs adequately allege that Google intercepted “communication[s] . . . in transit” and learned their “contents.”
a. Communications In Transit
Although there is some oddity in construing the collection of data related to app usage as involving “communications,” it is at least plausible that it does. When an Android user opens a non-Google app such as Instagram, the user begins communicating with Instagram that lasts for the period throughout the user‘s usage of the app. Therefore, at least at this stage, the Court finds that there is a communication involved. Cf. Revitch v. New Moosejaw, LLC, 2019 WL 5485330, at *1 (N.D. Cal. Oct. 23, 2019) (holding that a user‘s interactions with a shopping website was a communication under CIPA because the user requested information from the website and the website responded to the requests). Viewing the allegations in the light most favorable to Plaintiffs, Google‘s data collection could involve communications.
For similar reasons, at least for now, Plaintiffs adequately allege that the intercepted communications were in transit. Citing Bradley v. Google, Inc., Google contends that the communications here were in storage. Mot. at 6. But in Bradley, Google allegedly deleted and removed the plaintiff‘s emails the day after the plaintiff saved the emails to her Google account. 2006 WL 3798134, at *5-6 (N.D. Cal. Dec. 22, 2006). Accordingly, Bradley held that Google‘s practice was not an interception of electronic communications in transit but rather deletion of electronic communications in storage. Id. Here, Plaintiffs allege that the collection process occurred “when [users] interact with non-Google applications on their smartphones.” Compl. ¶ 4. While it is unclear whether Google‘s interception occurs solely when a user opens and exits Instagram, or occurs while the user uses Instagram, it is at least plausible that Google collects data during users’ usage of non-Google apps.
b. Contents
The CIPA claim nonetheless fails because Plaintiffs do not plead that Google learned the “contents” of the communications.
Courts employ a contextual “case-specific” analysis hinging on “how much information would be revealed” by the information‘s tracking and disclosure. Google Cookie Placement, 806 F.3d at 137-38. Generally, customer information such as a person‘s name, address, and subscriber number or identity is record information, but it may be contents when it is part of the substance of the message conveyed to the recipient. See id. at 137; Zynga, 750 F.3d at 1104, 1108-09. Similarly, URLs are record information when they only reveal a general webpage address and basic identification information, but when they reproduce a person‘s personal search engine queries, they are contents. See id. at 1108; Forrester, 512 F.3d at 510 n.6.
As noted above, the sensitivity of information collected by Google—and the plausibility of the collection of each sort of data—remains unclear. But at least as currently alleged, information about personal habits and identities that Google “infers” from the types of apps a user uses is not “content” of a communication. See Reply at 4. In Forrester, IP addresses that revealed the news websites (“nytimes.com“)—but not the particular articles—that users viewed were not “contents” because they could only allow “educated guess about what [users viewed] on the websites.” 512 F.3d at 510 n.6. Forrester noted that URLs that could reveal the particular articles users read would likely be “more [ ] problematic.” Id. Indeed, in Facebook Tracking, the Ninth Circuit concluded that URLs that could disclose the search terms users typed into the search engines were “contents” because they could provide “significant information regarding the user‘s browsing history” and divulge “a user‘s personal interests, queries, and habits on third-
This case is more analogous to Forrester than to Facebook Tracking. While Google might infer a user‘s traits and habits from the fact that this user uses non-Google apps designed for a specific purpose, the extent of that inference is limited because Plaintiffs do not allege Google can read the specific information (i.e., content) that a user inputs. Consider again Plaintiffs’ allegation that Google can learn about a user‘s menstrual cycle. From the activity data regarding the duration and frequency a user‘s use of a fertility tracker app, Google may infer that the user is a female and has the ability to get pregnant. However, it is implausible that Google can infer anything beyond that. And Google can extract even less information when the non-Google apps are not designed to serve specific purposes or specific groups of users. Google cannot infer anything from the fact that a person uses Instagram or Facebook. To constitute contents, the information intercepted by Google needs to identify the specific videos or document that the user views within Instagram or Facebook. See Reply at 4. As alleged, Google‘s data collection only allows Google to make “educated guesses” about a user‘s traits and habits, much like the IP addresses in Forrester. See 512 F.3d at 510 n.6.
None of Plaintiffs’ other cases are apposite. See Opp‘n at 20. In Google Cookie Placement, the Third Circuit suggested that a general scheme by Google of tracking the plaintiffs’ internet usage would likely involve collecting “at least some ‘content’ within the meaning of the Wiretap Act.” 806 F.3d at 139. But Plaintiffs fail to identify any content here. In Wesch, another court in this district held that individuals’ bank transaction histories constituted “contents” because they revealed personal details of the plaintiffs’ lives and expenditures. 2021 WL 1399291, at *4 (N.D. Cal. Jul. 19, 2021). Similarly, In re Vizio, Inc., Consumer Privacy Litigation ruled that individuals’ television program viewing records constituted contents. 2017 WL 11420284, at *6 (C.D. Cal. Jul. 25, 2017). The inferences available to Google in the instant case are far less personal, concrete, and detailed than the information in these two cases. See id.; Wesch, 2021 WL 1399291 at *4.
Because Plaintiffs fail to allege that Google intercepted “contents” of any
D. UCL Claim (claim 4)
The UCL is violated where a business practice is (1) unlawful, (2) unfair, or (3) fraudulent.
1. Unlawful Prong
Under the unlawful prong, injured customers base their claims on violations of other causes of actions. S. Bay Chevrolet v. Gen Motors Acceptance Corp., 72 Cal. App. 4th 861, 880 (1999) (internal citation omitted). If the predicate claims fail, the UCL claim also fails. Davis, 691 F.3d at 1168. Plaintiffs base their unfair competition claim on the common-law intrusion upon seclusion claim (claim 1), California Constitution claim (claim 2),
2. Unfair Prong
The UCL also prohibits business practices that are “unfair.”
E. Contract Claims (claims 6, 7, and 8)
1. Breach of Contract
To state a claim for breach of contract, Plaintiffs must allege four elements: (1) the existence of a contract, (2) plaintiffs’ performance under the contract, (3) defendant‘s breach, and (4) damage to plaintiff. Facebook Tracking, 956 F.3d at 610. The main element in dispute is whether Google breached the contract. Plaintiffs argue that Google breached the Terms of Service and the incorporated Privacy Policy in two ways: (1) violating its specific promise to collect data from third-party apps only if those apps use Google services; and (2) failing to disclose the true purpose of its data collection in claiming in its Privacy Policy that it collects data only to “provide better services.” Compl. ¶¶ 162-63.
In McCoy, Judge van Keulen held that Google lacked consent to collect usage data from non-Google apps to gain a competitive edge in the market against its rivals, and treated this as the basis for denying Google‘s motion to dismiss with regard to the breach of contract claim. 2021 WL 405816, at *6, *12. Although the Court agrees with McCoy that Google plausibly lacked consent, the Court respectfully disagrees that this means Google plausibly breached a contract. The question is whether Google breached anything that it promised, not whether Google did anything it did not promise. See Facebook Tracking, 956 F.3d at 610 (dismissing the breach of contract claim because Facebook‘s contract with the plaintiffs did not contain an explicit promise not to collect the data).
Plaintiffs’ second theory of breach fails too. Google never promised not to compete with rival companies. Instead, the Privacy Policy states that Google will collect data to provide better services—a promise that Plaintiffs do not allege that Google breached. See Kanig Decl. Ex. A at 16, Ex. B at 17.
The breach of contract claim therefore fails.
2. Implied Contract
Plaintiffs also raise a breach of implied contract claim. Compl. ¶ 167. An implied contract is one the existence and terms of the promise are “manifested by conduct.”
As Google correctly argues, “an action based on an implied-in-fact [contract] . . .
3. Unjust Enrichment
Plaintiffs plead in the alternative that Google received benefits from Plaintiffs in the form of the sensitive personal data that Google collected and unjustly retained those benefits. Compl. ¶¶ 179, 182-83. Google argues that (1) unjust enrichment is not an independent cause of action; (2) even if it were, the claim would fail because an enforceable agreement defines the parties’ rights; and (3) even if the claim were not precluded by an express agreement, Plaintiffs failed to allege that Google committed an actionable wrong and benefited at Plaintiffs’ expense. Mot. at 20.
California law on unjust enrichment remains somewhat unclear. In Astiana v. Hain Celestial Group., Inc., 783 F.3d 753, 762 (9th Cir. 2015), the Ninth Circuit held that unjust enrichment is not an independent cause of action but “describe[s] the theory underlying a claim that a defendant has been unjustly conferred a benefit through mistake, fraud, coercion, or request.” Id. When a plaintiff alleges unjust enrichment, a court may “construe the cause of action as a quasi-contract claim seeking restitution,” but this quasi-contract claim “does not lie when an enforceable, binding agreement exists defining the rights of the parties.” Id. at 762 (quoting Rutherford Holdings, LLC v. Plaza Del Rey, 166 Cal. Rptr. 3d 864, 872 (2014)); Paracor Fin., Inc. v. Gen. Elec. Capital Corp., 96 F.3d 1151, 1167 (9th Cir. 1996).
But even if unjust enrichment is an independent cause of action, Plaintiffs still have not plausibly pleaded an actionable wrong. As noted above, Plaintiffs fail to plead with particularity that Google committed an actionable misrepresentation or omission. And “when a plaintiff fails ‘to sufficiently plead an actionable misrepresentation or omission, his [or her] restitution claim must be dismissed.‘” Rojas-Lozano v. Google, Inc., 159 F. Supp. 3d 1101, 1120 (N.D. Cal. 2016) (internal citation omitted); Swearingen v. Health Beverage, LLC, 2017 WL 1650552, at *5 (N.D. Cal. May 2, 2017) (finding that the unjust enrichment claim failed because the plaintiffs failed to allege that they relied to their detriment on the defendants’ misrepresentations); Dinosaur Development, Inc., v. White, 216 Cal. App. 3d 1310, 1316 (1989) (for restitution, it “must ordinarily appear that the benefits were conferred by mistake, fraud, coercion or request; otherwise, though there is enrichment, it is not unjust.“). Accordingly, the unjust enrichment claim cannot stand.
The Court therefore GRANTS the motion to dismiss all three of the contract claims.
F. Declaratory Judgment (claim 9)
Finally, Plaintiffs seek relief under the Declaratory Judgment Act. Compl. ¶¶ 186-95. The Act provides that “[i]n a case of actual controversy within its jurisdiction ... any court of the United States ... may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought.”
IV. CONCLUSION
For the foregoing reasons, the Court GRANTS Google‘s Motion to Dismiss as to all claims. Although many of the problems noted above will be difficult to cure, the Court provides leave to amend. See Leadsinger, 512 F.3d at 532. Plaintiffs may file an amended complaint within 21 days of the date of this order.
IT IS SO ORDERED.
Dated: July 18, 2022
CHARLES R. BREYER
United States District Judge