Shahnaz Zarif, individually and on behalf of others similarly situated v. Hwareh.com, Inc.Shahnaz Zarif, individually and on behalf of others similarly situated v. Hwareh.com, Inc.
Plaintiff Shahnaz Zarif brings this putative class action arising out of her use of Defendant‘s online pharmacy, which markets and ships medications to California. She alleges Defendant surreptitiously captured sensitive information without her consent.
Previously, the Court dismissed Plaintiff‘s Complaint for lack of personal jurisdiction with leave to amend. Defendant now moves to dismiss Plaintiff‘s amended pleading on similar grounds. Defendant also seeks dismissal of Plaintiff‘s claims for lack of plausibility. Plaintiff opposes. The Court finds this matter suitable for determination on the papers submitted and without oral argument. See
BACKGROUND
I. HealthWarehouse.com
Defendant Hwareh.com, Inc. (“Health Warehouse“) is licensed as a non-resident pharmacy in California. (Third Am. Compl. (“TAC“) ¶ 28, ECF No. 25.) The pharmacy markets “physical products to California residents via its website“—HealthWarehouse.com—and sells “physical products including prescription drugs and other health care items on its website.” (Id.) Health Warehouse “delivered those physical products to thousands of California residents” over the past decade. (Id.)
To support this business, Health Warehouse promoted that it “[wa]s now licensed to ship Rx drugs to California” and California “[r]esidents c[ould] now save big on their Rx‘s + FREE shipping.” (Id. ¶ 41.) In another example, Health Warehouse shared that it was “interested in exposing the story behind high drug prices at retail pharmacies in Northern California” and
II. Privacy Claims
Plaintiff is a resident of San Diego, California, “and a customer of Defendant‘s website.” (TAC ¶ 118.) In March 2023, Plaintiff visited HealthWarehouse.com to search for “prescription medications for herself, her infant, and her elderly father.” (Id. ¶ 121.) Plaintiff did so “to determine availability and pricing for prescription drugs” on the website. (Id.) Plaintiff alleges her search terms and browsing history included medications concerning sleep troubles and anxiety for herself, “skin issues and other serious medical conditions” for her infant son, and “blood pressure and cholesterol medications” for her elderly father. (Id. ¶¶ 122–26.) Plaintiff does not allege that she ultimately purchased any medications, submitted a prescription, or otherwise engaged with the online pharmacy. (See id.)
According to Plaintiff, she believed her visits to HealthWarehouse.com “were private and would not be recorded or monitored for a later playback by Defendant.” (TAC ¶ 130.) Plaintiff alleges Health Warehouse employed the Facebook Pixel, a tracking tool, to record her activity and redirect the activity to Facebook for “business purposes.” (Id. ¶¶ 67, 138–43.) Health Warehouse also purportedly “deployed numerous other spyware software devices on its website that, much like Facebook Pixel,” captured “real-time communications” and transmitted “them in real time to these third-party spyware companies.” (Id. ¶ 155.) “This additional spyware [was] not used by Defendant as routine documentation of activities, but rather was engaged to do data mining,” and Health Warehouse “affirmatively engaged with this data for advertising and marketing purposes rather than simply storing it.” (Id.)
Based on these allegations, Plaintiff contends Health Warehouse violated various state and federal wiretapping and privacy statutes. (Id. ¶¶ 283–304.) Health Warehouse moves to dismiss the Third Amended Complaint under
PERSONAL JURISDICTION
I. Legal Standard
When raised as a defense by motion,
II. Analysis
Health Warehouse renews its argument that the Court lacks personal jurisdiction. (Mot. 6:13–8:21.) Jurisdiction over a defendant is proper if it is permitted by a long-arm statute and if the exercise of that jurisdiction does not violate
There are two types of personal jurisdiction: general and specific. Id. at 118. Only the second one is relevant here. Specific jurisdiction permits the court to exercise jurisdiction over a defendant who has availed itself through forum-related activities that gave rise to the action before the court. Bancroft & Masters, Inc. v. August Nat‘l Inc., 223 F.3d 1082, 1086 (9th Cir. 2000), overruled on other grounds in part by Yahoo! Inc. v. La Ligue Contre Le Racisme Et L‘Antisemitisme, 433 F.3d 1199 (9th Cir. 2006). The Ninth Circuit uses a three-pronged test for specific jurisdiction:
- The non-resident defendant must purposefully direct [its] activities or consummate some transaction with the forum or resident thereof; or perform some act by which [it] purposefully avails [itself] of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
- the claim must be one which arises out of or relates to the defendant‘s forum-related activities; and
- the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.
Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (9th Cir. 2004). The plaintiff bears the burden of proving the first two prongs and, if successful, the burden shifts to the defendant on the third prong to prove that jurisdiction is unreasonable. Id.
A. Purposeful Direction
As to prong one, for claims sounding in tort like those brought here, courts look to whether a defendant purposefully directed its activities at the forum state. Yahoo!, 433 F.3d at 1206. Courts apply the “effects” test from Calder v. Jones, 465 U.S. 783 (1984), to make this determination.
The Calder effects test asks “whether the defendant: ‘(1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.‘” Will Co., 47 F.4th at 922 (quoting Schwarzenegger, 374 F.3d at 803); see also Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. 351, 361 (2021). All three components must be met for a defendant to have purposefully directed its activities to the forum state. Pakootas v. Teck Cominco Metals, Ltd., 905 F.3d 565, 577 (9th Cir. 2018).
1. Intentional Act
The first component of the Calder effects test requires an intentional act by the defendant. Ayla, LLC v. Alya Skin Pty. Ltd., 11 F.4th 972, 980 (9th Cir. 2021). This requirement is met when the defendant acts with an “intent to perform an actual, physical act in the real world, rather than an intent to accomplish a result or consequence of that act.” AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1209 (9th Cir. 2020) (quoting Schwarzenegger, 374 F.3d at 806). Operating a website is an intentional act. Id. A defendant‘s “sale of [physical] products to [the forum‘s] residents” is likewise “an intentional act.” Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085, 1091 (9th Cir. 2023).
Plaintiff alleges Health Warehouse operates its “website as a storefront to make product sales,” and the pharmacy delivers physical products to California residents. (TAC ¶¶ 28, 36.) Accordingly, the intentional act prong is satisfied. See AMA, 970 F.3d at 1209; Herbal Brands, 72 F.4th at 1091.
2. Express Aiming
For the second element of the Calder effects test, the plaintiff must sufficiently allege a defendant “expressly aimed” its intentional act at the forum. Ayla, 11 F.4th at 980. The Court addressed this requirement in its two prior orders.
i. First Dismissal Order
The First Amended Complaint included allegations about Health Warehouse‘s website, but the pleading lacked the more detailed allegations about Health Warehouse‘s business summarized above, including that the pharmacy has delivered “physical products to thousands of California residents” and promoted its online store to California residents. (Compare First Amend. Compl. ¶¶ 38–43, ECF No. 9, with TAC ¶¶ 36–66.) Hence, when Health Warehouse moved to dismiss under
Under those cases, there must be “something more to indicate that the defendant purposefully (albeit electronically) directed [its] activity in a substantial way to the forum state.” Cybersell Inc. v. Cybersell Inc., 130 F.3d 418 (9th Cir. 1997). “Not all material placed on the Internet is, solely by virtue of its universal accessibility, expressly aimed at every state in which it is accessed.” Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1231 (9th Cir. 2011). But where “a website with national viewership and scope appeals to, and profits from, an audience in a particular state, the site‘s operators can be said to have ‘expressly aimed’ at that state.” Id.
Applying that line of authority, this Court found Plaintiff did not allege the “something more” required for express aiming. (First Dismissal Order 7:3–22.) She did “not allege that any products were shipped to California.” (Id. 7:17–18.) And although Plaintiff claimed Health Warehouse marketed to Californians, she did not provide any specifics. (Id. 7:13–15.) Thus, the Court dismissed the First Amended Complaint for lack of personal jurisdiction but gave Plaintiff leave to amend. (Id. 8:2–4.)
ii. Second Dismissal Order
Plaintiff filed a Second Amended Complaint, and Health Warehouse again moved to dismiss. To resolve the motion, the Court confronted Plaintiff‘s new allegation that Health Warehouse is selling “physical products to California residents” and delivering those products “to California residents.” (Second Dismissal Order 3:24–25, ECF No. 24.)
Relying on Briskin v. Shopify, Inc., 87 F.4th 404 (9th Cir. 2023), this Court found Plaintiff‘s allegations insufficient to show personal jurisdiction for claims of “extraction of consumer data.” (Second Dismissal Order 5:14–7:7.) Further, this Court followed Briskin‘s strictures and set aside Plaintiff‘s allegations concerning Health Warehouse selling and shipping products
iii. Express Aiming Absent Briskin
As the Court turns to Plaintiff‘s Third Amended Complaint, the ground has shifted in two spots. First, Plaintiff added examples of Health Warehouse‘s attempts to woo California customers to her pleading. (TAC ¶ 41.) Second, the Ninth Circuit vacated its opinion in Briskin and granted a rehearing en banc. 101 F.4th 706 (9th Cir. 2024).
The question, then, is whether Plaintiff demonstrates express aiming under the Ninth Circuit‘s caselaw absent Briskin. The Court finds that she does. First, as mentioned, Plaintiff includes allegations showing Health Warehouse attempted to appeal to and profit from California customers in particular. See Mavrix Photo, 647 F.3d at 1231.
Health Warehouse argues its promotional efforts from the early 2010s “are entirely irrelevant to any pertinent analysis.” (Mot. 7:21–22.) The Court is not persuaded. Plaintiff alleges these marketing efforts helped Health Warehouse target California customers, cultivate a California market, and deliver “physical products to thousands of California residents in California over the past decade or more.” (TAC ¶¶ 28, 42–48.) On the limited record before the Court, the implication is clear that Health Warehouse found success in targeting and exploiting the California market with its website. See Will Co., 47 F.4th at 921 (providing “[u]ncontroverted allegations in the complaint must be taken as true“).
Second, even setting aside the targeting of California residents, now that Briskin has been vacated, the case of Herbal Brands, Inc. v. Photoplaza, Inc., 72 F.4th 1085 (9th Cir. 2023), controls. Following Herbal Brands, this Court finds Health Warehouse expressly aimed its conduct at the forum by delivering physical products to thousands of California residents. “Although the internet can be dizzyingly complex, for jurisdictional purposes, the act of selling physical products over the internet to a forum resident is substantially the same as selling those same products to a forum resident through a mail-order catalog.” 72 F.4th at 1095. In other words, the sale of products to forum residents would provide the requisite “something more” even if Health Warehouse had not marketed its website to California residents. Id. at 1093. Thus, the Third Amended Complaint‘s factual allegations are sufficient to suggest Health Warehouse expressly aimed its conduct at California.
3. Harm in the Forum
The third prong of the Calder effects test asks whether the defendant caused harm that it knew is likely to be suffered in the forum state. Will Co., 47 F.4th at 922. “[T]his element does not require that the ‘brunt’ of the harm be suffered in the forum, . . . and . . . may be established even if ‘the bulk of the harm’ occurs outside the forum.” Brayton Purcell LLP v. Recordon & Recordon, 606 F.3d 1124, 1131 (9th Cir. 2010) (citing Yahoo!, 433 F.3d at 1207), abrogated on other grounds as recognized by Axiom Foods, Inc. v. Acerchem Int‘l, Inc., 874 F.3d 1064, 1069 (9th Cir. 2017).
Plaintiff alleges Health Warehouse “knew that it was going to harm California residents by enabling Facebook and other spyware companies to wiretap the residents’ communications.” (TAC ¶ 53.) The company knew “specifically which users were in California,” and Defendant purportedly knew it was improperly using tracking tools to capture users’ information. (Id. ¶¶ 53, 57, 155.) These allegations are sufficient to show Health Warehouse caused harm that it knew was likely to be suffered in California. See Will Co., 47 F.4th at 922; see also Swarts v. Home Depot, Inc., 689 F. Supp. 3d 732, 741 (N.D. Cal. 2023) (finding this element satisfied where the defendant allegedly knew “that it was recording its online chat conversations with customers, which could foreseeably cause harm in California“).
Thus, all three prongs of the Calder effects test are satisfied, and the Court finds that Health Warehouse purposefully directed its conduct towards California.
B. Relating to Forum Activities
“The second prong of the specific jurisdiction inquiry requires that a plaintiff‘s claims ‘arise out of or relate to the defendant‘s contacts’ with the forum.” Herbal Brands, 72 F.4th at 1096 (quoting Ford Motor, 592 U.S. at 359). “The first half of that standard asks about causation; but the back half, after the ‘or,’ contemplates that some relationships will support jurisdiction without a causal showing.” Ford Motor, 592 U.S. at 362.
Health Warehouse argues “none of the forum-related activities alleged are even tangentially related to Plaintiff‘s claims.” (Mot. 7:2–6.) This point is unavailing. Plaintiff alleges she is a customer of Healthwarehouse.com and browsed the site “to determine availability and pricing for prescription drugs.” (TAC ¶ 121.) A California customer browsing and shopping for prescription drugs is plainly related to Health Warehouse‘s forum activities of marketing, selling, and shipping prescription drugs to California residents. Further, Health Warehouse monitored and captured Plaintiff‘s browsing activity “to increase [its] business in the forum and to collect and share valuable data from consumers in California.” (Id. ¶ 52; see also id. ¶¶ 55, 135.) Thus, Plaintiff sufficiently alleges that her claims arise out of or relate to Health Warehouse‘s contacts with the forum. See Herbal Brands, 72 F.4th at 1096; see also Swarts, 689 F. Supp. 3d at 743 (reasoning data collection claims arising from website chat feature related to the defendant‘s sales and business contacts in California); Rodriguez v. Aquatic Sales Sols. LLC, No. 2:23-CV 05198-CAS-EX, 2024 WL 2804097, at *5 (C.D. Cal. May 29, 2024) (same).
C. Reasonableness
Because Plaintiff satisfies the first two prongs of the specific jurisdiction test, the burden shifts to Health Warehouse “to ‘present a compelling case’ that the exercise of jurisdiction would not be reasonable.” Schwarzenegger, 374 F.3d at 802 (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 476–78 (1985)). Health Warehouse does not attempt to make this showing here. (See Mot. 6:13–8:7.) Hence, the three-part specific jurisdiction test is satisfied. See Schwarzenegger, 374 F.3d at 802.
In sum, the Court finds exercising specific jurisdiction over Health Warehouse is appropriate, and the Court denies the Motion to Dismiss under
FAILURE TO STATE A CLAIM
I. Legal Standard
To avoid a
II. Analysis
A. Plaintiff‘s Consent
Health Warehouse‘s first argument is a global one. It contends Plaintiff consented to her data being collected, which would bar her privacy claims. (Mot. 9:1–11:16.)
However, Plaintiff repeatedly alleges she did not consent to Health Warehouse‘s conduct. (E.g., TAC ¶¶ 9, 70–71, 121, 129.) So, regardless of which party holds the burden of proof on this point, the factual allegations show Plaintiff‘s consent was lacking. See, e.g., India Price v. Carnival Corp., 712 F. Supp. 3d 1347, 1357 (S.D. Cal. 2024) (Curiel, J.) (reasoning a defendant‘s “consent defense appears premature” at the motion to dismiss phase “where the Court must take as true the Plaintiffs’ well-pleaded factual allegations“).
Recognizing this challenge, Health Warehouse asks the Court to consider several policies from Facebook‘s owner—Meta Platforms, Inc. Health Warehouse argues these policies show Plaintiff “consented to share information with Facebook when [she] registered as [a] Facebook user[] and [was] informed that Facebook tracks off-Facebook web activities, including those captured on third-party websites via Meta‘s Pixel.” (Mot. 9:15–22.) This argument does not go far. First, although these policies may address tracking through Meta‘s Pixel tool, the policies do not address Plaintiff‘s allegation that Health Warehouse “deployed numerous other spyware software devices on its website that, much like [Meta‘s] Pixel, contemporaneously and surreptitiously intercept[ed]” Plaintiff‘s activity for “data mining” to do advertising and marketing. (TAC ¶ 155; see also id. ¶¶ 156–88.)
Second, for these policies to defeat Plaintiff‘s claims at this stage, the policies must have only one plausible interpretation showing Plaintiff consented to the conduct. See In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 794 (N.D. Cal. 2022). “For consent to be actual, the disclosures must ‘explicitly notify’ users of the conduct at issue.” Calhoun v. Google, LLC, 113 F.4th 1141, 1147 (9th Cir. 2024). “In other words, consent is only effective if the person alleging harm consented ‘to the particular conduct, or to substantially the same conduct’ and if the alleged tortfeasor did not exceed the scope of that consent.” Brown v. Google LLC, 685 F. Supp. 3d 909, 926 (N.D. Cal. 2023) (citing Restatement (Second) of Torts § 892A (1979)). Here, Defendant does not show the policies unambiguously allowed it to capture and share information like the specific prescription drugs Plaintiff was searching for to purchase for herself and family members. Cf. Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 793 (reasoning the “generalized notice” in Meta‘s policies did not “specifically indicate that Meta may acquire health data“); Castillo v. Costco Wholesale Corp., No. 2:23-CV-01548-JHC, 2024 WL 4785136, at *12 (W.D. Wash. Nov. 14, 2024) (rejecting a similar argument involving online pharmacy services).
Hence, the Court is unpersuaded by Health Warehouse‘s argument that Plaintiff‘s claims cannot proceed because she consented to the data harvesting.
B. Wiretap Act
1. Contents of Any Communication
Health Warehouse raises several challenges to Plaintiff‘s first claim for violation of the Wiretap Act. Initially, Defendant argues Plaintiff cannot state a claim because Health Warehouse did not intercept the “contents” of any communication. (Mot. 11:17–12:20.) Health Warehouse contends Plaintiff‘s “mouse clicks and movements, keystrokes, search terms, and pages and content viewed by [her]” are not “contents” under the Wiretap Act. (Mot. 11:8–10 (quoting Jacome v. Spirit Airlines Inc., No. 2021-000947-CA-01, 2021 WL 3087860, at *4 (Fla. Cir. Ct. June 17, 2021)).)
With exceptions, the Wiretap Act—also known as the Electronic Communications Privacy Act—prohibits a person from intentionally using or disclosing to any other person the “contents” of an intercepted electronic communication.
In Zynga Privacy Litigation, the Ninth Circuit interpreted the definition of “contents” to mean “the intended message conveyed by the communication.” 750 F.3d 1098, 1106 (9th Cir. 2014). The contents of a communication are distinguishable from the “record information,” which is “information regarding the characteristics of the message that is generated in the course of the communication.” Id. For example, in the phone call setting, the call‘s “origination, length, and time” are not the call‘s contents—but instead record information—because those items contain “no ‘information concerning the substance, purport, or meaning of [the] communication.‘” United States v. Reed, 575 F.3d 900, 917 (9th Cir. 2009) (alteration in original) (quoting
Zynga Privacy Litigation concerned web browser requests that included a “referrer header that provided both the user‘s Facebook ID and the address of the Facebook webpage the user was viewing when the user clicked the link.” 750 F.3d at 1102. The Ninth Circuit reasoned this information was record information because it included “only basic identification and address information, not a search term or similar communication made by the user.” Id. at 1109.
The Ninth Circuit anticipated that in other circumstances, however, a user‘s request to a search engine for specific information could constitute a communication where a web address included the user‘s search term. Id. 1108–09. Further, the Ninth Circuit approved a First Circuit decision that concluded a “defendant was disclosing the contents of a communication” where “the users had communicated with the website by entering their personal medical information into a form provided by a website.” Id. at 1107 (citing In re Pharmatrak, Inc., 329 F.3d 9, 18–19 (1st Cir. 2003)).
Plaintiff‘s allegations encapsulate more than unprotected “record information.” She claims Health Warehouse disclosed her “searches for prescription medications for herself, her infant, and her elderly father.” (TAC ¶ 121; see also id. ¶¶ 124–26 (providing examples of the searches).) The search terms Plaintiff entered into Health Warehouse‘s website concern “the substance, purport, or meaning
2. Intentional Interception
Health Warehouse next argues Plaintiff “has not alleged the requisite intent” for her Wiretap Act claim. (Mot. 12:21–13:13.) The statute imposes liability on a person who “intentionally” intercepts or discloses protected communications.
Caselaw forecloses this challenge. The Ninth Circuit rejected that the word “intentionally” in the Wiretap Act “must be read to require a defendant to know that [its] conduct is unlawful.” United States v. Christensen, 828 F.3d 763, 774 (9th Cir. 2015). Rather, the statute only requires “an intentional act, defined as ‘an act that is being done on purpose.‘” Id. at 775 (quoting S. Rep. No. 99–541, at 24 (1986)). Hence, “the operative question under [the Wiretap Act] is whether the defendant acted consciously and deliberately with the goal of intercepting wire communications.” Id.
Plaintiff alleges Health Warehouse acted deliberately when it deployed tracking software that intercepted her communications. (TAC ¶¶ 8, 15, 67, 99.) Her allegations are enough to allege Health Warehouse acted intentionally, and Defendant‘s argument to the contrary is unavailing.
3. Interception While in Transit
Health Warehouse seeks dismissal of the Wiretap Act claim because “Plaintiff does not plausibly allege any communication was intercepted ‘while in transit.‘” (Mot. 14:11–15:3.) The law defines “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.”
Plaintiff alleges the tracking software employed by Health Warehouse intercepted her electronic communications “contemporaneously” and “simultaneously” and redirected them to third-parties, including Meta. (TAC ¶¶ 54, 153, 155–56.) These allegations plausibly state the interception element. See
Health Warehouse raises another consent argument that is tailored to the Wiretap Act claim. Defendant argues it consented to the interceptions as a party to the communications, which can defeat the claim. (Mot. 13:22–14:10.) The statute provides:
It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.
The Complaint alleges Health Warehouse intentionally used software to intercept and acquire the contents of Plaintiff‘s communications for advertising and marketing purposes. (TAC ¶ 238.) The only reasonable inference that can be drawn from this allegation is that Health Warehouse consented to the interceptions. And because the Wiretap Act is a one-party consent statute, Health Warehouse is exempt from liability—regardless of whether Plaintiff consented—so long as Health Warehouse did not act “for the purpose of” committing any crime or tort.
The crime-tort exception focuses on whether “the purpose for the interception—its intended use—was criminal or tortious.” Sussman v. Am. Broad. Cos., 186 F.3d 1200, 1202 (9th Cir. 1999) (emphasis in original). The plaintiff “must allege that either the ‘primary motivation or a determining factor in [the defendant‘s] actions has been to injure plaintiffs tortiously.‘” Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 797 (quoting Brown, 525 F. Supp. 3d at 1067).
Several decisions from the Northern District of California have reasoned “that the crime-tort exception to the Wiretap Act is inapplicable where the defendant‘s primary motivation was to make money, not to injure plaintiffs tortiously.” Id.; see also Rodriguez v. Google LLC, No. 20-CV-04688-RS, 2021 WL 2026726, at *6 n.8 (N.D. Cal. May 21, 2021) (finding the exception inapplicable where Google‘s alleged interceptions occurred with the consent of application developers and were financially motivated); In re Google Inc. Gmail Litig., No. 13-MD-02430-LHK, 2014 WL 1102660, at *18 (N.D. Cal. Mar. 18, 2014) (Koh, J.) (reasoning the tort or crime exception cannot apply where the interceptor‘s “purpose has plainly not been to perpetuate torts on millions of Internet users, but to make money” (quoting In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 524 (S.D.N.Y. 2001))).
The picture is murkier if a defendant is capturing health information on a website. Courts have reached different results. Compare Doe v. Kaiser Found. Health Plan, Inc., No. 23-CV-02865-EMC, 2024 WL 1589982, at *10 (N.D. Cal. Apr. 11, 2024) (reasoning plaintiffs failed to plead Kaiser had a tortious purpose when it
In response to Health Warehouse‘s Motion, Plaintiff argues the Court should apply the crime-tort exception. (Opp‘n 10:11–12:20.) Arguments in an opposition, however, are not enough. The Complaint‘s allegations for the Wiretap Act cause of action do not address the purpose of Health Warehouse‘s interceptions. (See TAC ¶¶ 234–39.) Elsewhere, Plaintiff alleges her communications were intercepted and transmitted “to third-party spyware companies for purposes of targeting advertising to Defendant‘s California website users.” (Id. ¶ 54; see also id. ¶¶ 134, 155 (alleging Health Warehouse engaged with the data for advertising and marketing purposes).) Plaintiff‘s allegations are insufficient to implicate the crime-tort exception. See, e.g., In re Google Inc. Gmail Litig., 2014 WL 1102660, at *18 n.13.
Thus, the Court finds this final challenge to the Wiretap Act claim is compelling. The Court dismisses the claim for lack of plausibility. Because this dismissal is the first one touching on the merits of the claim, the Court grants Plaintiff leave to amend her Wiretap Act claim.
C. California‘s Invasion of Privacy Act
1. Section 631—Eavesdropping
Moving beyond the Wiretap Act claim, Defendant contends Plaintiff fails to state a claim under California‘s Invasion of Privacy Act (“CIPA“). Plaintiff pleads two CIPA claims. First, in her second cause of action, she alleges Health Warehouse violated
The overlap between these claims covers many of Health Warehouse‘s arguments under
i. Applicability to Internet Communications
Health Warehouse contends
Section 631 has two clauses: It punishes (1) persons who tap telegraph or telephone wires, lines, cables, and instrumentsand (2) persons who attempt to learn in an unauthorized manner the contents of communications passing over any wires, lines, and cables. The first clause applies only to “telegraph and telephone” wires, lines, cables or instruments, while the second clause applies to “any wire, line, or cable.” As a result, courts have concluded that the first clause does not apply to internet connections, while the second clause does.
Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1051 (S.D. Cal. 2023) (citation omitted) (collecting cases). The second clause is plainly the one at issue here, and Health Warehouse‘s argument that
ii. Extension of the Website
Health Warehouse contends the tracking software it employed is an “extension” of its website that harvests data for its own use, so there is no forbidden third-party eavesdropper under
Dueling caselaw exists for Health Warehouse‘s position. Under the first line of cases, software vendors can be viewed as “‘extension[s]’ of the websites that employ them, and thus not third parties within the meaning of the statute.” Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 899 (N.D. Cal. 2023) (citing Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021)). These cases reason that the tracking defendant provides a tool, much like a tape recorder, and therefore is a participant in the conversation, not an eavesdropper. Graham, 533 F. Sup. 2d at 832–833. The other cases reach the opposite result: they find third parties that capture and interpret users’ data can run afoul of
In Javier, Judge Breyer found the argument advanced by defendants like Health Warehouse raises two problems. First, the argument relies on “the intentions and usage of the prospective third party,” but the relevant portion of
This reasoning is persuasive. Plaintiff alleges third-party data harvesters received her communications, and those parties had the capability to use the data for their own benefit. (TAC ¶¶ 135–36, 138–40.) The tracking software Defendant employed thus “extends beyond the ordinary function of a tape recorder” and is more akin to “an eavesdropper standing outside the door.” See Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1081 (C.D. Cal. 2021). Consequently, Health Warehouse‘s argument that the tracking software was simply an “extension” of its
iii. Extraterritoriality
Defendant argues CIPA does not apply to extraterritorial conduct, and Plaintiff “fails to allege that the challenged conduct occurred in California.” (Mot. 22:26–23:9.)
Health Warehouse is based in Kentucky. (TAC ¶ 79.) Plaintiff alleges she is a California resident, and her communications originated “from her home in the Clairemont neighborhood in San Diego.” (Id. ¶ 120.) Thus, Plaintiff sufficiently alleges that her communications were “being sent from . . . any place within this state.” See
2. Section 638.51—Pen Register
Plaintiff‘s second CIPA claim is her sixth cause of action. She alleges Health Warehouse violated
Health Warehouse argues the Meta Pixel and similar tracking software do “not qualify as a pen register or trap and trace device as those terms are defined by the statute.” (Mot. 19:12–20:2.) This Court has rejected such a narrow reading of
Health Warehouse also argues that even if the tracking software falls under
D. California‘s Computer Data Access and Fraud Act
The Court next turns to Plaintiff‘s fifth cause of action for violation of
1. Without Permission
The statute does not define “without permission.” In Greenley, this Court reasoned “the phrase ‘without permission’ is not limited to conduct that circumvents a device barrier or ‘hacks’ a computer system.” 684 F. Supp. 3d at 1049 (citing In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1099 (N.D. Cal. 2015)). The Greenley defendant was a data broker who provided a software developer kit (“SDK“) for use in applications. Id. at 1035. “Defendant coded its SDK for data collection and embedded it in third-party apps; the SDK secretly collected app users’ data; and then Defendant packaged that data and sold it to clients for advertising purposes.” Id. at 1035. Given those allegations, the Court concluded: “Code hidden in embedded software may plausibly use or take computer data ‘without permission‘” in violation of
Similarly, in Meta Healthcare Pixel Litigation, the plaintiffs alleged Meta altered their computers “in violation of (c)(1) by (i) usurping their normal operation; (ii) surreptitiously placing [a] cookie on them; and (iii) causing the computers to redirect Plaintiffs’ data to Meta.” 713 F. Supp. 3d 628, 656 (N.D. Cal. 2024). The court reasoned those allegations were enough to plausibly suggest a violation of CDAFA. Id.; see also Esparza v. Kohl‘s, Inc., 723 F. Supp. 3d 934, 938 (S.D. Cal. 2024) (allowing a CDAFA claim to proceed where the defendant used a third-party‘s chat technology that “secretly install[ed] a ‘persistent cookie’ on every user‘s device” and “de-anonymize[d] website visitors“).
2. Access
“Access” means to “cause output from” the “logical, arithmetical, or memory function resources of a computer.”
Construing these allegations in Plaintiff‘s favor, they are enough to suggest Defendant “accessed” her computer. See
3. Damage or Loss
Health Warehouse challenges whether Plaintiff plausibly states she suffered a loss due to the alleged CDAFA violation. (Mot. 22:6–25.) To bring a claim under CDAFA, a party must allege that it “suffer[ed] damage or loss by reason of a violation” of the statute.
The only theory of loss Plaintiff identifies is that “Defendant was unjustly enriched” by using her data “for Defendant‘s own financial benefit.” (TAC ¶ 294.) But Plaintiff fails to allege facts showing Health Warehouse was in fact unjustly enriched. Instead, her allegation, like that in Facebook Tracking Litigation, is directed at the profits third parties make when they sell user data to generate revenue. See 956 F.3d at 600–01 (reasoning the plaintiffs alleged Facebook “profited from [their] valuable data” where “Facebook sold user data to advertisers in order to generate revenue” and “ad sales constituted over 90% of the social media platform‘s revenue during the relevant period of logged-out user tracking“). Plaintiff does not allege Health Warehouse sold her data or other facts supporting the assertion that Defendant was unjustly enriched by using tracking tools to collect her data. See Roe v. Amgen Inc., No. 2:23-CV-07448-MCS-SSC, 2024 WL 2873482, at *7 (C.D. Cal. June 5, 2024) (dismissing similar CDAFA claim). Therefore, Plaintiff‘s allegations do not state a plausible CDAFA violation, and the Court dismisses this claim with leave to amend.
E. California‘s Confidentiality of Medical Information Act
Plaintiff‘s third cause of action is for violation of
Health Warehouse contends the CMIA claim is implausible because Plaintiff “fails to allege that she was a ‘patient.‘” (Mot. 24:7–16.) The CMIA defines a “patient” as “a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.”
The Court is unconvinced that Plaintiff states a viable CMIA claim. In Opposition, Plaintiff points to her allegation that she is a “patient of Defendant, as defined in Civil Code § 56.05(k),” and “Defendant maintains personal medical information of Plaintiff” within the meaning of the CMIA. (TAC ¶¶ 263–64.) Yet a formulaic recitation of the elements of a cause of action is not enough to survive a
F. California Consumer Privacy Act
Last, Defendant asks the Court to dismiss Plaintiff‘s fourth claim under the
Health Warehouse highlights that the Complaint does not include factual allegations showing one of the CCPA‘s thresholds applies to Defendant. (Mot. 27:3–28:19.) Plaintiff responds that she is pleading the CCPA claim in the event that Health Warehouse is not subject to the CMIA. (Opp‘n 29:3–12.) Even so, she must still plausibly allege the CCPA applies here, and she does not do so. Hence, the Court dismisses the CCPA claim with leave to amend.
CONCLUSION
In light of the foregoing, the Court GRANTS IN PART and DENIES IN PART Health Warehouse‘s Motion to Dismiss. (ECF No. 29.) The Court denies Defendant‘s motion to dismiss this action for lack of personal jurisdiction under
In addition, the Court grants in part Defendant‘s motion to dismiss Plaintiff‘s
- Grants the request to dismiss Plaintiff‘s first claim for violation of the Wiretap Act with leave to amend.
- Denies the request to dismiss Plaintiff‘s second claim for violation of California‘s Invasion of Privacy Act,
California Penal Code § 631 . - Grants the request to dismiss Plaintiff‘s third claim for violation of California‘s Confidentiality of Medical Information Act with leave to amend.
- Grants the request to dismiss Plaintiff‘s fourth claim for violation of the California Consumer Privacy Act of 2018 with leave to amend.
- Grants the request to dismiss Plaintiff‘s fifth claim for violation of California‘s Computer Data Access and Fraud Act.
- Denies the request to dismiss Plaintiff‘s sixth claim for violation of California‘s Invasion of Privacy Act,
California Penal Code § 638.51 .
If Plaintiff wishes to file a Fourth Amended Complaint, she must do so no later than March 5, 2025. Plaintiff may not add any new claims or parties without leave of court. Defendant shall respond to any amended pleading no later than March 19, 2025. Should Plaintiff decide not to amend, Defendant shall file its answer to the Third Amended Complaint no later than March 19, 2025.
IT IS SO ORDERED.
DATED: February 12, 2025
Hon. Cynthia Bashant
United States District Judge