Turner v. Microsoft CorporationTurner v. Microsoft Corporation
This action began with two separately-filed putative class actions in which three named plaintiffs alleged that Defendant Nuance Communications, Inc. (“Nuance“) violated the California Invasion of Privacy Act (“CIPA“). The court consolidated the matters on May 31, 2023 and Plaintiffs subsequently filed a consolidated amended class action complaint. [Docket No. 34 (“CFAC“).] Nuance moves to dismiss the CFAC for failure to state a claim under
I. FACTUAL BACKGROUND
Plaintiffs make the following allegations in the CFAC, all of which are taken as true for purposes of the motion to dismiss.1 Nuance “markets and provides an artificial intelligence software-as-a-service that allows businesses to authenticate their customers’ identities with their voice,” called “Gatekeeper.” CFAC ¶ 1. Gatekeeper is a voice recognition software which “records a consumer‘s voice, creates a biometric voice print of the caller, and then examines that voiceprint to determine whether the caller is a potential fraudster in future calls, and above all—to determine whether the caller is telling the truth when identifying themselves and attempting to gain access to their customer account.” Id. at ¶ 4. Businesses can license Gatekeeper and integrate it into their call centers to verify callers’ identities. Id. at ¶¶ 5, 27.
Nuance‘s marketing describes its Gatekeeper product as an “AI Risk Engine” which uses “[d]eep neural networks” to “analyze biometric, non-biometric, and other available data to make intelligent authentication and fraud risk assessments.” Id. at ¶ 31. Plaintiffs allege that Nuance “analyzes ‘more than 1,000 characteristics’ of a person‘s unique voice, such as the sound of a person‘s voice, how they talk, what they say, their pattern of speech,
Plaintiffs claim that Nuance creates voice prints without the consumer‘s “knowledge or express written consent.” Id. at ¶ 37. Nuance‘s software “seamlessly incorporates into its customers’ call centers, without adequate notice (or any at all) that Nuance . . . is even involved in the call.” Id. Plaintiffs allege that Nuance “listens to the consumer‘s voice quietly in the background of a call, and in such a way that consumers will likely be entirely unaware they are unknowingly interacting with a third-party company.” Id. at ¶ 3.
According to Plaintiffs, Nuance‘s voice recognition service exposes customers to significant risks. For example, Plaintiffs state that voices are highly personal and can reveal sensitive information about an individual‘s mental state and behaviors. Id. at ¶ 6. They also aver that artificial intelligence is “extremely susceptible to racial and gender bias,” and that voice examination technology has been known to mistakenly classify legitimate customers as fraudsters based on their voice, locking them out of their accounts and finances. Id. at ¶¶ 34-35. In addition, they allege that Nuance‘s system can be “easily fooled” by fraudsters, such as by using a free online AI voice cloning service with an audio recording of a person‘s voice. Id. at ¶ 36.
Plaintiff Turner called Chase‘s customer support call center on numerous occasions, including most recently in October 2022. Id. at ¶ 44. Turner alleges that she reasonably expected her conversation with Chase to be confidential because Chase was a banking entity, “which naturally involves the discussion of confidential information,” and because Turner spoke to Chase on her personal telephone and not in the direct presence of others. Id. at ¶ 45. During the call with Chase, Turner was asked to make various “yes” or “no” statements in order to respond to questions Chase asked her, or to otherwise provide additional information to Chase. Id. at ¶ 46. Unbeknownst to Turner, her call was recorded by Nuance‘s technology, which created a voice print for Turner and automatically enrolled her voice print in Nuance‘s biometric voice print database. Id. at ¶¶ 47-48. Turner asserts that she did not give her consent, written or otherwise, to “allow Nuance to wiretap her confidential communications with Chase.” Id. at ¶¶ 50-51.
Plaintiffs Smith and Youshei allege similar facts. They both called Chase‘s customer support call center multiple times during the past three years. Id. at ¶¶ 54, 63. They allege that they reasonably expected their conversations with Chase to be confidential. Id. at ¶¶ 55, 64. However, their calls were recorded by Gatekeeper, which created a voice print for each Plaintiff and automatically enrolled the voice prints in Nuance‘s biometric voice print database.
Plaintiffs assert that Nuance violated
II. PROCEDURAL BACKGROUND
Turner brought a putative class action on October 6, 2022. [Docket No. 1.] Turner filed a first amended class action complaint on January 9, 2023. [Docket No. 19.] Smith and Youshei also brought a putative class action, which the court related to Turner‘s case on March 30, 2023. [Docket No. 27.] The cases were subsequently consolidated on May 31, 2023. [Docket No. 33.] Plaintiffs filed the CFAC on June 14, 2023. Nuance now moves to dismiss the CFAC.
III. LEGAL STANDARD
A motion to dismiss under
As a general rule, a court may not consider “any material beyond the pleadings” when ruling on a
IV. DISCUSSION
California enacted CIPA in 1967 “to replace prior laws that permitted recording of telephone conversations when one party consents.” Lopez v. Apple, Inc., 519 F. Supp. 3d 672, 688 (N.D. Cal. 2021) (citing Flanagan v. Flanagan, 27 Cal. 4th 766, 768 (2002)). The Legislature was responding to concerns “that advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications.”
Plaintiffs bring claims under three sections of CIPA:
Section 631 is titled “Wiretapping.”
(1) intentionally taps, or makes any unauthorized connection . . . with any telegraph or telephone wire, line, cable, or instrument,
(2) or who willfully and without the consent of all parties to the communication . . . reads, or attempts to read, or to learn the contents or meaning of any message . . . while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state;
(3) or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained.
Section 632 is titled “Eavesdropping on or recording confidential communications.” It imposes liability on any person who “intentionally and without the
Plaintiffs also assert a claim under
Nuance moves to dismiss all of Plaintiffs’ claims by arguing that Plaintiffs gave priorwritten consent to be recorded in their phone calls with Chase. Nuance also moves to dismiss the
A. Consent
To make out a claim under
Plaintiffs assert that “[n]either Nuance nor Chase disclosed” to Plaintiffs that their voices were being “recorded or analyzed by Nuance to make a voice print . . . for the purposes of determining the truth or falsity of [Plaintiffs‘] statements. Likewise, [Plaintiffs] did not give [their] consent, written or otherwise, to either Nuance or Chase to allow Nuance to wiretap [their] confidential communications with Chase.” CFAC ¶¶ 50, 59, 68. Nuance contends that Plaintiffs provided express written consent. Mot. 4. It requests that the court take judicial notice of eight exhibits which it asserts demonstrate Plaintiffs’ consent, contradicting Plaintiffs’ allegations in the CFAC. [Docket No. 50 (Request for Judicial Notice, “RJN“); 50-1 (Deck Decl., July 17, 2023) Exs. A-E; 50-2 (Moore Decl., July 18, 2023) Exs. A-C.] Plaintiffs do not dispute the authenticity of the documents, instead arguing that the language of the documents is too ambiguous to constitute consent to Nuance‘s conduct. Opp‘n 7.
A district court generally may not consider any material beyond the pleadings in ruling on a
The overuse and improper application of judicial notice and the incorporation-by-reference doctrine . . . can lead to unintended and harmful results. Defendants face an alluring temptation to pile on numerous documents to their motions to dismiss to undermine the complaint, and hopefully dismiss the case at an early stage. Yet the unscrupulous use of extrinsic documents to resolve competing theories against the complaint risks premature dismissals of plausible claims that may turn out to be valid after discovery. . . . If defendants are permitted to present their own version of the facts at the pleading stage—and district courts accept those facts as uncontroverted and true—it becomes near impossible for even the most aggrieved plaintiff to demonstrate a sufficiently “plausible” claim for relief. Such undermining of the usual pleading burdens is not the purpose of judicial notice or the incorporation-by-reference doctrine.
Id. (internal citations omitted).
In contrast, the incorporation by reference doctrine is “a judicially-created doctrine thattreats certain documents as though they are part of the complaint itself.” Id. at 1002. This is to prevent “plaintiffs from selecting only portions of documents that support their claims, while omitting portions that weaken—or doom—their claims.” Id. Incorporation by reference is appropriate “if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff‘s claim.” Id. at 1002 (quoting Ritchie, 342 F.3d at 907). However, if a document “merely creates a defense to the well-pled allegations in the complaint, then that document did not necessarily form the basis of the complaint.” Id. Further, “the mere mention of the existence of a document is insufficient to incorporate the contents of a document.” Id. (quoting Coto Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010)). The Ninth Circuit has instructed that “the doctrine is not a tool for defendants to short-circuit the resolution of a well-pleaded claim.” Id. Thus, “while a court may assume [an incorporated document‘s] contents are true for purposes of a motion to dismiss under
According to Nuance‘s RJN, Exhibits A-C to the Declaration of Laura Deck are iterations of the Deposit Account Agreement (“DAA“) which were in effect when Plaintiffs opened their accounts with Chase Bank. Deck Decl. ¶¶ 2-7. Exhibits D-E are iterations of the DAA which were in effect when Plaintiffs filed their class action lawsuits. Id. at ¶¶ 12-13. Some versions of the DAAs include the language: “We may record and/or monitor any of our telephone conversations with you. . . . We may use your voice to verify your identity.” Id. Exs. A, D and E § VI.C. All of the DAAs also include a Privacy Notice, which states that Chase “can share your personal information” “[f]or our everyday business purposes—such as to process your transactions [and] maintain your account(s)[.]” Id. Exs. A-E at Privacy Notice at 1. Exhibit A to the Declaration of Christopher Moore is a copy of the Personal Electronic Signature Card digitally signed by Plaintiff Turner when she opened an account with Chase Bank. Moore Decl. ¶ 7. It states that Turner “read and agree[d] to the . . . Deposit Account Agreement.” Id. Ex. A at 1.Exhibits B-C are copies of the Personal Signature Cards signed by Plaintiffs Youshei and Smith when they opened accounts with Chase Bank. Id. at ¶¶ 8-9. The signature cards state that they “acknowledge[d] receipt of the Bank‘s Deposit Account Agreement . . . and agree[d] to be bound by the terms and conditions contained therein as amended from time to time.” Id. Exs. B-C at 1. The copies of the DAA and the signature cards were taken from Chase‘s records. Deck Decl. ¶ 1; Moore Decl. ¶ 2.
Nuance argues that the exhibits are incorporated by reference because lack of consent forms the basis of their CIPA claims. See Garcia v. Enter. Holdings, Inc., 78 F. Supp. 3d 1125, 1136 (N.D. Cal. 2015) (finding that lack of consent is an express element of a CIPA claim). In Garcia, the court took judicial notice of the defendant Zimride‘s Terms of Service and Privacy Policy because the plaintiff‘s claim “necessarily depend[ed] on the application of Zimride‘s policies—which relate directly to the issue of consent.” Id. Nuance argues that, likewise, Plaintiffs’ claims depend on the contents of the DAA.
Garcia was decided before Khoja clarified the proper standard for judicial notice and is not binding on this court. Under Khoja, there are only “rare instances when assessing the sufficiency of a claim” requires the incorporation of materials that the complaint did not reference at all, such as a defamation claim where the plaintiff did not include the context of the allegedly defamatory publication. Khoja, 899 F.3d at 1002 (citing Knievel v. ESPN, 393 F.3d 1068 (9th Cir. 2005)). This case is not one of those “rare instances” because it is possible to assess the sufficiency of Plaintiffs’ claims on the face of the complaint. See id. Plaintiffs clearly alleged that they were not aware and did not consent to Nuance‘s software recording and examining their voices. CFAC ¶¶ 50-51, 59-60, 68-69. Plaintiffs did not rely on the DAA for any of their claims. Nuance cites to several cases
Alternatively, Nuance argues that its exhibits are subject to judicial notice because thecurrent version of the DAA appears on a publicly available website. The court is not persuaded that just because the latest version of a document is publicly available, all prior versions of the document are judicially noticeable. To the contrary, Nuance admits that the DAA has been revised multiple times over the years, so the current version of the DAA may not be the same as the version Plaintiffs allegedly read. Cf. Hammerling v. Google LLC, No. 21-CV-09004-CRB, 2022 WL 17365255, at *4 (N.D. Cal. Dec. 1, 2022), aff‘d, No. 22-17024, 2024 WL 937247 (9th Cir. Mar. 5, 2024) (declining to take judicial notice of the most recent privacy policy of the defendant because it may be different from the version read by plaintiffs).
Even if the court could take judicial notice of the DAA, there is a factual dispute over whether the DAA sufficiently notified Plaintiffs of Nuance‘s conduct. A court can find consent on a motion to dismiss if the disclosures “‘explicitly notify’ users of the practice at issue. . . . The disclosures must have only one plausible interpretation for a finding of consent.” Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (quoting In re Google, Inc., 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013)). Plaintiffs argue that the language of the DAA only discloses that Chase, not third parties, may record consumers’ voices. Opp‘n 8. Plaintiffs also contend that the language in the Privacy Policy does not notify consumers that their live phone conversations may be intercepted by third parties to create voice prints. Opp‘n 8-11. This is a factual dispute which is not appropriate for resolution at the pleadings stage. See In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019) (“[I]f the contract language at issue is reasonably susceptible to more than one interpretation, with one of those interpretations suggesting consent and another belying it, the Court cannot decide the consent issue in [the defendant‘s] favor at the motion to dismiss stage.“); McCoy v. Alphabet, Inc., No. 20-CV-05427-SVK, 2021 WL 405816, at *6 (N.D. Cal. Feb. 2, 2021) (declining to find consent on a motion to dismiss because defendant did not disclose how it used plaintiffs’ data with the sufficient “level of specificity“).3
The court denies Nuance‘s request for judicial notice and denies the motion to dismiss on the issue of consent.
B. “Third Party” Under Sections 631 and 632
Participants in a conversation cannot be held liable for unauthorized wiretapping under
To make out their claims under
Two seminal California Supreme Court cases delineate when a defendant is a third party and when a defendant merely provides a tool to a participant in the conversation. In Ribas, the court found that third-party liability is triggered when there is an “unannounced second auditor” to a conversation, such as when a participant invites a third person to simultaneously “listen on an extension telephone” to a conversation with an unknowing participant. Ribas v. Clark, 38 Cal. 3d 355, 358-361 (1985). By contrast, in Rogers, the court found that third-party liability is not triggered if a participant uses a “tape recorder jack . . . installed on [the] telephone by the telephone company” to record a phone conversation and later play it back to a third party. Rogers, 52 Cal. App. 3d at 897-99. Therefore, the question before the court is whether Nuance‘s artificial intelligence software is more like the “unannounced second auditor” in Ribas, or the “tape recorder” in Rogers. Put differently, “the question boils down to whether [Nuance] was an independent third party hired to eavesdrop on [Chase‘s] communications, or whether [Nuance‘s] software was merely a tool that [Chase] used to record its own communications with plaintiff.” See Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *3 (N.D. Cal. Dec. 22, 2022).
Nuance argues that it is not a third party because the alleged artificial intelligence software does not capture communications for Nuance‘s own uses, but only to facilitate Chase‘s purposes. Mot. 10. Nuance cites Graham v. Noom, Inc., which found that third-party liability was not triggered where a software-as-a-service (“SaaS“) provider captured a client website‘s visitor data, hosted the data on the SaaS provider‘s servers, and allowed the client to review that data. 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021). In Graham, the defendant FullStory developed a software
Plaintiffs make two counter-arguments: (1) Graham is distinguishable on its facts, and (2) Graham incorrectly interpreted the statute because a SaaS provider does not have to use the intercepted data for its own purposes to qualify as a third party. Opp‘n 18-20. As to the first point, Plaintiffs argue that the SaaS provider in Graham was more like a tape recorder because it was only capable of capturing and storing data for the client‘s review. See Graham, 533 F. Supp. 3d at 832-33. In contrast, Nuance is not like a tape recorder because it uses captured data to conduct sophisticated biometric analyses, such as creating voice prints and authenticating customers. CFAC ¶¶ 28-31. For this reason alone, Plaintiffs argue that Graham does not apply.
To support the second point, Plaintiffs cite Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 520 (C.D. Cal. 2021) and Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. 2023), which both found that the statutory language of
There is a split in the Ninth Circuit on the standard used to define a third party. On this issue, Javier is instructive. Judge Breyer identified two problems with including the defendant‘s actual use of the intercepted data as a necessary element to prove that the defendant is a third party. Javier, 649 F. Supp. 3d at 900. The first is that “use” is already an element of the third clause of
Second, the California Supreme Court in Ribas did not consider the alleged eavesdropper‘s intentions or how they used the information they obtained. Javier, 649 F. Supp. 3d at 900 (citing Ribas, 38 Cal. 3d at 360-61). “Instead, [the Ribas court] emphasized the privacy concerns at issue with having an ‘unannounced second auditor’ listening in on the call, when
The court is persuaded by the reasoning in Javier, tracking a growing number of district courts which have reached the same conclusion. See, e.g., Balletto v. Am. Honda Motor Co., No. 23-CV-01017-JSW, 2023 WL 7026931, at *2 (N.D. Cal. Oct. 24, 2023); Yockey v. Salesforce, Inc., No. 22-CV-09067-JST, --- F.Supp.3d ---, 2023 WL 5519323, at *5 (N.D. Cal. Aug. 25, 2023); Valenzuela v. Super Bright LEDs Inc., No. EDCV2301148JAKSPX, 2023 WL 8424472, at *7 (C.D. Cal. Nov. 27, 2023); Rodriguez v. Ford Motor Co., No. 323CV00598RBMJLB, --- F.Supp.3d ---, 2024 WL 1223485, at *13 (S.D. Cal. Mar. 21, 2024).
Nuance does not contend that its services are ubiquitous. The question therefore turns on whether Nuance had the “capability” to use the recorded phone conversations for its own purposes. See Javier, 649 F. Supp. 3d at 900. “To ask a plaintiff to plead with great particularity exactly what a third-party software company is capable of doing with data gathered from defendant‘s website sets the pleading bar too high. . . . However, a plaintiff still must have at least pled some non-conclusory factual allegations to support the use capabilities of the third-party software company involved.” Heiting v. Taro Pharms. USA, Inc., No. 2:23-CV-08002-SPG-E, --- F.Supp.3d ---, 2023 WL 9319049, at *4 (C.D. Cal. Dec. 26, 2023). The Balletto cases provide helpful guidance on sufficient pleading of capability. In Balletto I, the court granted thedefendant‘s motion to dismiss because the plaintiff failed to show that the SaaS provider, Salesforce, was a third party. 2023 WL 7026931, at *1-2. The plaintiff‘s complaint alleged that Salesforce “analyze[d] customer-support agent interactions in real time to create live transcripts of” chat communications on the client‘s website. Id. at *1. The court found that this did not support a reasonable inference that Salesforce was capable of using the communications for any purpose other than furnishing them to the client. Id. at *3. After amendment, the court in Balletto II allowed the complaint to go forward. Balletto v. Am. Honda Motor Co., No. 23-CV-01017-JSW, 2024 WL 589090, at *3 (N.D. Cal. Feb. 13, 2024). The plaintiff added allegations that Salesforce “intercepts . . . communications and sends those communications to its Einstein data intelligence platform. . . . Salesforce then has the capability to use the information contained in chats ‘to (i) improve Salesforce‘s own products and services; (ii) develop new Salesforce products and services; and (iii) analyze Chat communications to assist with customer service interactions and data analytics.‘” Id. at *1 (citation omitted). This was sufficient to show that Salesforce was a third party. Id. at *3.
Plaintiffs have sufficiently alleged that Nuance is capable of using intercepted data for purposes other than furnishing the data back to the client. The CFAC
Plaintiffs have adequately alleged that Nuance is an independent third party. Nuance‘s motion to dismiss Plaintiffs’ claims under
C. Failure to State a Claim Under Section 631
Nuance argues that Plaintiffs have failed to state a claim under the second and third clauses of
1. Contents or Meaning
In order to state a claim under the second clause of
Nuance argues that its software only analyzes the “characteristics” of the allegedly intercepted communications, namely the speaker‘s identity. Mot. 14. This ignores Plaintiffs’ allegations that Nuance authenticates consumers by analyzing the substance of their conversations with Chase, including “word choice, grammar, syntax, and other elements across messaging and transcribed voice interactions.” CFAC ¶ 30. Nuance‘s challenge fails because this is clearly content, not just “characteristics” of communications. In the simplest terms, Plaintiffs allege that Nuance identifies speakers by analyzing “[w]hat they say.” CFAC ¶ 31.
2. Use of Information
In order to establish a claim under the third clause of
Nuance appears to conflate “use” under the third clause of
To the contrary, the statutory language prohibits the use of intercepted communications “in any manner, or for any purpose.”
Nuance does not dispute that Plaintiffs have alleged that Nuance “uses its recordings of customers’ voices to create voice prints, which Nuance then uses to assess whether customers are who they purport to be and sends real-time alerts to Chase to confirm the identities of customers.” [Docket No. 53 (Reply) 13.] Nuance‘s only argument is that the alleged uses were for the benefit of Chase, not Nuance. Id. But “[n]othing more is required” to show use under the third clause of
Nuance‘s motion to dismiss Plaintiffs’
D. Failure to State a Claim Under Section 637.3
There are very few cases about the application of
Plaintiffs urge the court to extend
At the hearing, Plaintiffs stated that they can amend their complaint to plead
V. CONCLUSION
Defendant‘s motion to dismiss Plaintiffs’ claims under CIPA
IT IS SO ORDERED.
Dated: May 28, 2024
Donna M. Ryu
Chief Magistrate Judge