Opperman v. Kong Technologies, Inc.Opperman v. Kong Technologies, Inc.
Before the Court is Defendant Yelp, Inc.’s motion for summary judgment. The Court will deny the motion.
I. BACKGROUND
Plaintiffs challenge conduct by Apple and various developers of applications (“apps”) for Apple devices. See Second Consolidated Amended Complaint (“SCAC”), ECF No. 478. Plaintiffs allege that Yelp and other app developers improperly uploaded address book data from their phones without their consent. See, e.g., id. ¶¶ 119-120. Yelp now moves for summary judgment on the ground that Plaintiffs consented to allow this uploading.
A. Contacts Data
The facts of this putative class action have been recited in detail in prior orders and require only a brief summary here. Each Apple device comes pre-loaded with a “Contacts” app that owners may use as an address book to input and store various information about the owner’s contacts. Id. ¶ 54, 55. The Plaintiffs allege that this information “is highly personal and private, and “is not shared, is not publicly available, is not publicly accessible, and is not ordinarily obtainable by a third party unless the owner physically relinquishes custody of his or her device to another individual.” Id. ¶ 56. Plaintiffs further allege that Yelp and other app developers uploaded their contacts data without their consent.
The Yelp app introduced a Friend Finder” feature on approximately January 16, 2010.1 ECF No. 689-1 ¶ 4. This feature allowed Yelp users to locate other Yelp users they know by comparing the email addresses in the user’s local Contacts app with a database of email addresses of registered Yelp users. Id. ¶ 2.
Yelp’s “Friend Finder” feature was only available to registered Yelp users who agreed to Yelp’s Terms of Service and Privacy Policy. Id. ¶¶ 2, 3. To create a Yelp account, a user must complete the online registration process by accessing Yelp’s website on a computer or through the mobile app. Id. Before a user can advance past the first page of the registration process, he or she must click on a red button. Id. ¶ 3. The following statement appears above the red button: “By clicking the button below, you agree to Yelp’s Terms of Service and Privacy Policy.”2 Id. In turn, if one clicks on the blue hyperlinked text reading “Terms of Service” or “Privacy Policy,” he or she is taken to a web page that displays those policies. Id. The Yelp Privacy Policy in effect on
Contacts: You can invite your friends to join the Site by providing their contact information or by allowing us to use your address book from your computer, mobile device, or other sites. If you invite a friend to join and connect with you on the Site, we may use and store your friends’ contact information long enough to process your requests.
Request for Judicial Notice in Support of Yelp’s Motion for Summary Judgment, ECF No. 690, Ex. B at 2.3 The Yelp Privacy Policy in effect on May 26, 2009 included the following notice about contacts data:
You may choose to provide us with another person’s e-mail address so that person may be invited to create an account on this website and become your friend. We use this information to contact and, if necessary, remind that person about the invitation. By providing us with another person’s e-mail address, you represent to us that you have obtained the consent of the person concerned as regards such disclosure to us of their personal information. All invitees are provided with the option not to receive further invitations.
Id., Ex. A at 4. Once the user created a Yelp account and agreed to the Terms of Service and Privacy Policy, he or she would be able to access the “Friend Finder” feature in the Yelp app on their mobile device. ECF No. 689-1 ¶ 4.
A registered Yelp user who navigated to the “Friend Finder” feature between January 16, 2010 and February 22, 2012 would see the following pop-up dialog box:
Id.4 Between February 22, 2012 and March 8, 2012, the dialog box was changed to read the following: “Find Friends. We’ll need to look at your contacts to find friends. Don’t worry, we’re not storing them.” Id. Underneath that dialog box, the user could select either “No Thanks” or “OK.” Id. During either time period, if the user clicked “Yes, Find Friends” or “OK” the Yelp app transmitted the email addresses in the user’s Contacts app to Yelp’s servers and cross-checked those email addresses against the email addresses of registered Yelp users. Id. ¶ 5.
C. Apple’s Review of the Yelp App
As an app developer, Yelp was bound by several contracts with Apple. Yelp entered into a Program License Agreement (“PLA”) in which it appointed Apple as its “worldwide agent for the delivery of [its app].” ECF No. 727-6, Ex. C at 2, 7-8, § 3.1(e). The PLA provides that “applications may not collect user or device data without prior user consent.” Id. at 9, § 3.3.9. Yelp was also subject to Apple’s App Store Review Guidelines. ECF No. 727-5, Ex. B at 3, § 1.1. Guideline 17.1 provides that “[a]pps cannot transmit data about a user without obtaining the user’s prior permission and providing the user with access to information about how and where the data will be used.” Id. at 16, § 17.1.
In response to this internal investigation, Yelp changed its pop up dialog box to display the following message: “To find friends, we’ll need to upload your contacts to Yelp. Don’t worry, we’re not storing them.” ECF No. 689-1 ¶ 4 (emphasis added); ECF No. 727-7, Ex. D at 2; ECF No. 727-4, Ex. A at 3. The Plaintiffs do not challenge Yelp’s conduct after these changes were implemented. ECF No. 727 at 16:2.
D. Public Response
Around the same time Apple was conducting its internal investigation, major media sources began reporting about the alleged privacy breach. See Plaintiff’s Request for Judicial Notice, ECF No. 749, Exs. A-F; Plaintiff’s Request for Judicial Notice, ECF No. 728, Exs. A-F.5 Congress reacted by opening an inquiry into Apple’s privacy practices. See ECF No. 748-11, Ex. J; ECF No. 748-12, Ex. K; see also Protecting Mobile Privacy: Your Smartphones, Tablets, Cell Phones and Your Privacy: Hearing Before the Subcommittee on Privacy, Tech. and the Law of the S. Judiciary Comm., 112th Cong. (2011), available at
E. Procedural History
Plaintiffs brought this suit against Apple and several app developers, including Yelp, as a putative class action.6 See ECF Nos. 362, 478. The Plaintiffs allege that Yelp uploaded address book data from their Contacts app without their consent. See SCAC, ECF No. 478, ¶¶ 2, 119, 120, 146, 178, 184, 195, 208. Based on these allegations, the Plaintiffs assert a cause of action for invasion of privacy (intrusion upon seclusion) against Yelp. See id. ¶¶ 243-255 (alleging that Yelp and the other App defendants “intentionally intruded on and into each respective Plaintiff’s solitude, seclusion or private affairs” by “surreptitiously obtaining, improperly gaining knowledge, reviewing and retaining Plaintiffs’ private address books (or substantial portions thereof) as stored in the Contacts App on Plaintiffs’ iDevices”). This is the only remaining claim against Yelp. See ECF Nos. 471, 543 (dismissing all other claims).
II. JURISDICTION
The Court has subject matter jurisdiction over this action under the Class Action Fairness Act of 2005. The amount in controversy exceeds the sum or value of $5,000,000, exclusive of interests and costs; there are 100 or more class members; and there is minimal diversity because certain members of the class are citizens of a different state than any Defendant as required by
III. LEGAL STANDARD
Summary judgment is proper when a “movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.”
Where the party moving for summary judgment would bear the burden of proof at trial, that party bears the initial burden of producing evidence that would entitle it to a directed verdict if uncontroverted at trial. See C.A.R. Transp. Brokerage Co. v. Darden Rests., Inc., 213 F.3d 474, 480 (9th Cir. 2000). Where the party moving for summary judgment would not bear the burden of proof at trial, that party bears the initial burden of either producing evidence that negates an essential element of the non-moving party’s claim, or showing that the non-moving party does not have enough evidence of an essential element to carry its ultimate burden of persuasion at trial.
If the moving party satisfies its initial burden of production, then the non-moving party must produce admissible evidence to show that a genuine issue of material fact exists. See Nissan Fire & Marine Ins. Co. v. Fritz Cos., 210 F.3d 1099, 1102–03 (9th Cir. 2000). The non-moving party must “identify with reasonable particularity the evidence that precludes summary judgment.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996). Indeed, it is not the duty of the district court to “to scour the record in search of a genuine issue of triable fact.” Id. “A mere scintilla of evidence will not be sufficient to defeat a properly supported motion for summary judgment; rather, the nonmoving party must introduce some significant probative evidence tending to support the complaint.” Summers v. Teichert & Son, Inc., 127 F.3d 1150, 1152 (9th Cir. 1997) (citation and internal quotation marks omitted). If the non-moving party fails to make this showing, the moving party is entitled to summary judgment. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986).
Under California law,7 a claim for intrusion upon seclusion has two elements: (1) intrusion into a private place, conversation or matter, (2) in a manner highly offensive to a reasonable person. Shulman v. Grp. W Prods., Inc., 18 Cal. 4th 200, 231 (1998), as modified on denial of reh’g (July 29, 1998); see also Restatement (Second) of Torts § 652B (1977) (“One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person”). The Court now addresses whether the Plaintiffs have produced evidence of these elements such that they could carry their burden at trial.
A. Consent
Yelp argues that the Plaintiffs’ intrusion upon seclusion claim fails as a matter of law because the Plaintiffs consented to allow Yelp to access their local Contacts app to find friends, thereby defeating any reasonable expectation of privacy in their address book data and any potential intrusion upon seclusion claim. See ECF No. 689 at 18-19.
Effective consent negates an intrusion upon seclusion claim. See Restatement (Second) of Torts § 892A (1979) (“One who effectively consents to conduct of another intended to invade his interests cannot recover in an action of tort for the conduct or for harm resulting from it.”). To satisfy the first element of an intrusion upon seclusion claim, the plaintiff must have had “an objectively reasonable expectation of seclusion or solitude in the place, conversation or data source.” Shulman, 18 Cal. 4th at 232; see also Varnado v. Midland Funding LLC, 43 F. Supp. 3d 985, 992 (N.D. Cal. 2014). And a plaintiff cannot have a reasonable expectation of privacy if she consented to the intrusion. Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 26, 865 P.2d 633 (1994) (“The plaintiff in an invasion of privacy case must have conducted himself or herself in a manner consistent with an actual expectation of privacy, i.e., he or she must not have manifested
However, consent is only effective if the person alleging harm consented “to the particular conduct, or to substantially the same conduct” and if the alleged tortfeasor did not exceed the scope of that consent. Restatement (Second) of Torts § 892A (1979) §§ 2(b), 4. After all, “privacy, for purposes of the intrusion tort, is not a binary, all-or-nothing characteristic.” Sanders v. Am. Broad. Companies, Inc., 20 Cal. 4th 907, 916 (1999). “There are degrees and nuances to societal recognition of our expectations of privacy: the fact that the privacy one expects in a given setting is not complete or absolute does not render the expectation unreasonable as a matter of law.” Id.
Yelp argues that the Plaintiffs “allowed . . . Yelp’s access to their Contacts list to perform the precise function they desired: to connect with their friends to improve the Apps’ social networking experiences.” ECF No. 689 at 19. In response, the Plaintiffs argue that consent to “access” or “look at” their contacts is not the same as consent to “upload” those contacts. ECF No. 727 at 23. In other words, “permission to look at data does not equate with permission to take it.” Id. at 7. At the summary judgment stage, the Court agrees with the Plaintiffs.
There is a material factual dispute as to whether Yelp’s in-app user prompt obtained effective consent to upload the address book data to its servers. The Plaintiffs point to several pieces of evidence that a reasonable fact-finder could rely on to find in their favor. First, the textual in-app display did not explicitly disclose that Yelp would “upload” the address book data to its own servers in order to perform the matching function. Rather, the text of the disclosure during the class period simply told users that the feature would “[f]ind friends on Yelp using your Contacts” or “look at your contacts to find friends.” ECF No. 689-1 ¶ 4. And the Plaintiffs have produced evidence suggesting that, based on these disclosures, they expected a matching process that would take place locally on their phone, not on Yelp’s servers. See Depo. Tr. of Claire
Nor can the Court conclude as a matter of law that Yelp’s additional layer of disclosure—its Terms of Service and Privacy Policy—obtained effective consent to upload users’ contacts data to its servers. Yelp argues that “each Plaintiff consented to that access not once but at least twice, first when registering as a Yelp user and agreeing to be bound by the Terms of Service and Privacy Policy, and again when using the Friend Finder function.” ECF No. 689 at 19:13-15. There are two problems with Yelp’s reliance on its Privacy Policy, however. First, it is unclear whether the hyperlinked, off-screen terms in the Privacy Policies provided users with constructive notice such that they could effectively consent to anything contained off-screen. In fact, Ninth Circuit precedent suggests otherwise:
[W]here a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on—without more—is insufficient to give rise to constructive notice. While failure to read a contract before agreeing to its terms does not relieve a party of its obligations under the contract, the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers.
Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1178–79 (9th Cir. 2014) (internal citations
Throughout its briefing, Yelp argues that the Plaintiffs’ intrusion upon seclusion claim only survived the prior motions to dismiss because the Plaintiffs alleged that Yelp “misused” or “misappropriated” the address book data in other, unauthorized ways ‒ such as storing, disseminating, or selling the data. ECF No. 689 at 7-8, 13; ECF No. 759 at 14, 17. Accordingly, Yelp argues that, because the Plaintiffs have not produced evidence of these particular kinds of unauthorized use their claim fails as a matter of law. Id.
Yelp reads the Court’s previous orders and the crux of the Plaintiffs’ allegations too narrowly. The Court has not said, and the Plaintiffs have not alleged, that these are the only ways that Yelp could have overstepped the bounds of the consent it obtained. Rather, the Plaintiffs also
Yelp relies on two cases to further support its consent argument: Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 26 (1994) and Perkins v. LinkedIn Corp., 53 F. Supp. 3d 1190 (N.D. Cal. 2014). ECF No. 689 at 18. Both cases are distinguishable.
In Hill, student athletes brought invasion of privacy claims against the NCAA under the California Constitution based on the NCAA’s requirement that student athletes undergo drug testing. The California Supreme Court held that the athletes manifested voluntary consent to the testing, thereby defeating their invasion of privacy claim. See Hill, 7 Cal. 4th at 42. However, the plaintiffs in that case were “required to sign a three-part statement and consent form,” which included the following “Drug-Testing Consent” provision: “By signing this part of the form, you certify that you agree to be tested for drugs.” Id. at 11. Based on this explicit consent form, the Court held that the student athletes had a diminished expectation of privacy. Id. at 42. Here, unlike in Hill, Yelp’s brief screen prompt did not explicitly disclose that it would upload users’ address book data. Hill does not dispose of the present case.
Perkins is also distinguishable. In that case, the court held that LinkedIn remained within the scope of the consent that it obtained from users when it sent an email inviting their contacts to join LinkedIn, but that it exceeded the scope of that consent when it sent subsequent reminder emails. Id. at 1215-17. LinkedIn’s disclosures said “Why not invite some people?” and “Stay in touch with your contacts who aren’t on LinkedIn yet. Invite them to connect with you.” Id. at 1215. If a user agreed to invite people, LinkedIn sent an email to the contact that said “I’d like to
In fact, Yelp’s argument ignores Perkins’ implicit holding that consent is defined by the scope of its terms. Yelp argues that “[o]nce Plaintiffs consented to Yelp’s access to that information, the alleged tort evaporates; there is no invasion to begin with, and subsequent transmission cannot change that.” ECF No. 689 at 13:9-10. In contrast, the California Supreme Court has said that “privacy, for purposes of the intrusion tort, is not a binary, all-or-nothing characteristic.” Sanders, 20 Cal. 4th at 916. Rather, “[t]here are degrees and nuances to societal recognition of our expectations of privacy,” and “the fact that the privacy one expects in a given setting is not complete or absolute does not render the expectation unreasonable as a matter of law.” Id.; see also e.g., Sheehan v. San Francisco 49ers, Ltd., 45 Cal. 4th 992 (2009) (“Hill does
In response, Yelp argues that “the operation of the Friend Finder function . . . inevitably requires that data be transmitted from the users’ phone to Yelp’s servers for processing.” ECF No. 759 at 14:8-10. This statement misses the point. The question is not whether Yelp’s engineers establish during litigation that the only feasible way to compare the users’ contacts to registered Yelp users is to upload the contacts to Yelp’s server. The question is whether, and to what extent, the Plaintiffs effectively consented to allow Yelp to use their contact data at the time of the challenged invasion.8 Cf. Hill, 7 Cal. 4th at 26 (“The plaintiff in an invasion of privacy case must have conducted himself or herself in a manner consistent with an actual expectation of privacy,
Perhaps recognizing that the consent inquiry hinges on whether the Plaintiffs’ expectations were objectively reasonable, Yelp next argues that the Plaintiffs did not have to understand that their contacts data would be uploaded to Yelp’s servers in order to effectively consent to the Friend Finder function. ECF No. 759 at 14-15. In other words, Yelp argues that “consent to [the Friend Finder] process does not require the user to understand how the process works.” Id. After all, Yelp argues, “[w]e consent to all sorts of things every day without the slightest idea how they are accomplished.” Id.
But the details about how the process works matter to the consent analysis if those details involve conduct that transcends what was consented to and interferes with the Plaintiffs’ objectively reasonable expectations of privacy. Shulman, 18 Cal. 4th at 232. Here, the Plaintiffs have presented evidence that the act of uploading their contacts’ email addresses without their permission changed the nature of Yelp’s intrusion. For example, one of the Plaintiffs testified that she “gave Yelp permission to access [her] contacts,” but not to “upload [her] contacts on to their servers.” Depo. Tr. of Claire Hodgins, ECF No. 759-3 at 106:23-107:5. She further testified that uploading the data was qualitatively different than accessing it because “uploading means that you can then use that information how you please.” ECF No. 777-3 at 5:7-12. Other Plaintiffs testified that the act of uploading the contacts data to a server was “egregious,” and that they didn’t consent to Yelp “taking” their information by moving it from their phone to somewhere else. Depo. Tr. of Nirali Mandalaywala, ECF No. 777-2 at 7:5-18; Depo. Tr. of Giuliana Biondi, ECF No. 777-4 at 3:18-4:4. It remains to be seen whether these expectations were objectively reasonable, but that is a question for the jury, not this Court. See Shulman, 18 Cal. 4th at 233-34 (reversing the lower court’s grant of summary judgment as to the plaintiff’s intrusion upon seclusion claim because the determination as to whether the plaintiff’s expectation of privacy was reasonable was a “question[] for the jury”).
Next, Yelp argues that the Plaintiffs cannot succeed on their intrusion upon seclusion claim as a matter of law because “identifying social connections to users is far from a ‘highly offensive’ practice.” ECF No. 689 at 17:14-15.
To prevail on an invasion of privacy claim, the intrusion must also be “highly offensive to a reasonable person and sufficiently serious and unwarranted as to constitute an egregious breach of the social norms.” Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 295 (2009) (internal citations and quotation marks omitted). “A court determining the existence of ‘offensiveness’ would consider the degree of intrusion, the context, conduct and circumstances surrounding the intrusion as well as the intruder’s motives and objectives, the setting into which he intrudes, and the expectations of those whose privacy is invaded.” Miller v. Nat’l Broad. Co., 187 Cal. App. 3d 1463, 1483-84 (Ct. App. 1986). “California tort law provides no bright line on [offensiveness]; each case must be taken on its facts.” Hernandez, 47 Cal. 4th at 1073 (quoting Shulman, 18 Cal. 4th at 237) (internal quotation marks omitted). “[W]hat is ‘highly offensive to a reasonable person’ suggests a standard upon which a jury would properly be instructed.” Deteresa v. Am. Broad. Companies, Inc., 121 F.3d 460, 465 (9th Cir. 1997) (quoting Miller, 187 Cal. App. 3d at 1483). However, “there is a preliminary determination of ‘offensiveness’ which must be made by the court in discerning the existence of a cause of action for intrusion.” Id. “If the undisputed material facts show no reasonable expectation of privacy or an insubstantial impact on privacy interests, the question of invasion may be adjudicated as a matter of law.” Id. (internal citations and quotation marks omitted).
Yelp argues that “mechanical access to a list of email addresses in order to perform a commonplace social media function is far short of conduct that shocks the conscience, or so transgresses social norms that it can be deemed outrageous” and that “such commercial uses of address information are not ‘highly offensive.’” ECF No. 689. In other words, Yelp argues that uploading address book data without users’ consent is not highly offensive because it is “commonplace” and “commercial” in nature. Id. at 17:17-18.
Yelp relies heavily on Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986 (2011), as
Yelp’s reliance on Folgelstrom is not persuasive. The offensiveness inquiry is fact-specific, and this Court has already distinguished Folgelstrom because the data at issue here is “more private than a person’s mailing address” and this kind of intrusion is not “routine commercial behavior.” ECF No. 471 at 47-48. For the same reason, the Court is not persuaded by cases that have mechanically applied Folgelstrom to invasion of privacy claims. See, e.g., In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012); In re Google, Inc. Privacy Policy Litig., 58 F. Supp. 3d 968, 988 (N.D. Cal. 2014).
In re iPhone Application Litig. involved the disclosure to third parties of an iDevice user’s unique device identifier number, personal data, and geolocation information. 844 F. Supp. 2d at 1063. That court held without explanation that “[e]ven assuming this information was transmitted without Plaintiffs’ knowledge and consent, a fact disputed by Defendants, such disclosure does not constitute an egregious breach of social norms,” citing Folgelstrom. Id. As noted above, however, Folgelstrom addressed different facts than those in iPhone Application Litigation, and the latter court did not explain how expansion of Folgelstrom’s holding, counter to the privacy interests of iDevice users, was consistent with California’s community privacy norms.
Fundamentally, this case is about whether Apple’s conduct and that of application developers violated community norms of privacy. “A ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly based and widely accepted community norms.” Hill, 7 Cal. 4th at 37. The “community norms” aspect of the “reasonable expectation of privacy” element means that “‘[t]he protection afforded to the plaintiff’s interest in his privacy must be relative to the customs of the time and place, to the occupation of the plaintiff and to the habits of his neighbors and fellow citizens.’” In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1038 (N.D. Cal. 2014) (quoting TBG Ins. Servs. Corp. v. Superior Court, 96 Cal. App. 4th 443, 450, (2002)).
Those customs and habits are very much in flux. The technology underlying the allegations in this case is still developing. The iPhone was introduced less than ten years ago, Charles Arthur, “The History of Smartphones: Timeline,” Guardian UK Jan. 24, 2012 (on-line ed) (https://www.theguardian.com/technology/2012/jan/24/smartphones-timeline), and the prospect of
In sum, this is not ‒ or is not yet ‒ a question that can be decided as a matter of law, and there is a triable issue of fact regarding whether Yelp’s upload of the Plaintiffs’ address book data was highly offensive to a reasonable person.
C. Copyright Act Preemption
Finally, Yelp argues that under the Plaintiffs’ theory its “copying of the Plaintiffs’ contact information becomes the only act alleged against Yelp” such that the claim is preempted by the Copyright Act. ECF No. 689 at 19-20.
The Copyright Act preempts a state law claim if: (1) the plaintiff asserts “rights that are equivalent” to those protected by the Copyright Act as defined in
Assuming the collection of email addresses falls within the “subject matter” of the Copyright Act,11 the Plaintiffs’ state law privacy rights are nonetheless qualitatively different from
As explained in
CONCLUSION
In conclusion, there are genuine issues of material fact as to both the scope of the consent that Yelp obtained and whether uploading the Plaintiff’s address book data remained within that scope. Accordingly, the Court denies Yelp’s motion for summary judgment.
IT IS SO ORDERED.
Dated: September 8, 2016
JON S. TIGAR
United States District Judge