United States District Court, N.D. California, San Jose Division
July 21, 2014
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
For Robert B. De Mars, individually and on behalf of all others similarly situated, Lorena Barrios, individually and on behalf of all others similarly situated, Nicholas Anderson, Pedro Marti, Matthew Villani, Scott McCullough, Plaintiffs: Diane Zilka, LEAD ATTORNEY, PRO HAC VICE, Grant and Eisenhofer, Wilmington, DE; James J Sabella, PRO HAC VICE, Grant and Eisenhofer, Wilmington, DE; Kelly A. Noto, LEAD ATTORNEY, PRO HAC VICE, Gardy & Notis LLP, Englewood Cliffs, NJ; Kyle J McGee, LEAD ATTORNEY, PRO HAC VICE, Grant and Eisenhofer P.A., Wilmington, DE; Martin Stuart Bakst, LEAD ATTORNEY, Attorney at Law, Encino, CA; Annick Marie Persinger, Lawrence Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA; James S. Notis, PRO HAC VICE, Gardy & Notis, LLP, Englewood Cliffs, NJ; Jennifer Sarnelli, Mark C. Gardy, Gardy & Notis, LLP, Englewood Cliffs, NJ; Orin Kurtz, Gardy and Notis, LLP, New York, NY; Sarah Nicole Westcot, Bursor and Fisher, P.A., Walnut Creek, CA; Yeremey O. Krivoshey, Bursor Fisher, P.A., Walnut Creek, CA.
For David Nisenbaum, Plaintiff: Diane Zilka, LEAD ATTORNEY, PRO HAC VICE, Grant and Eisenhofer, Wilmington, DE; Kelly A. Noto, LEAD ATTORNEY, PRO HAC VICE, Gardy & Notis LLP, Englewood Cliffs, NJ; Kyle J McGee, LEAD ATTORNEY, PRO HAC VICE, Grant and Eisenhofer P.A., Wilmington, DE; Annick Marie Persinger, Lawrence Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA; Orin Kurtz, Gardy and Notis, LLP, New York, NY; Yeremey O. Krivoshey, Bursor Fisher, P.A., Walnut Creek, CA; Sarah Nicole Westcot, Bursor and Fisher, P.A., Walnut Creek, CA.
For Google, Inc., Defendant: Michael Henry Page, LEAD ATTORNEY, Durie Tangri LLP, San Francisco, CA.
ORDER GRANTING-IN-PART MOTION TO DISMISS AND GRANTING MOTION TO STRIKE (Re: Docket Nos. 71, 77)
PAUL S. GREWAL, United States Magistrate Judge.
Over two years ago, Plaintiffs filed this lawsuit against Defendant Google, Inc. for commingling user data across different Google products and disclosing such data to third parties. Since then, the court has twice dismissed Plaintiffs' claims. Google now moves for a third dismissal.
Like Rocky rising from Apollo's uppercut in the 14th round, Plaintiffs' complaint has sustained much damage but just manages to stand. The court GRANTS the motion, but only IN-PART.
Google is a technology and advertising company that provides free web-based products to billions of consumers around the world. Google can offer its products free of charge due to its primary business model -- advertising. In 2011, Google's revenues were $37.91 billion, approximately 95% of which ($36.53 billion) came from advertising. In 2012, Google's revenues increased to $46.04 billion, approximately 95% of which ($43.69 billion) came from advertising.
In order to accomplish this, Google logs personal identifying information, browsing habits, search queries, responsiveness to ads, demographic information, declared preferences and other information about each consumer that uses its products. Google's Gmail service also scans and discloses to other Google services the contents of Gmail communications. Google uses this information, including the contents of Gmail communications, to place advertisements that are tailored to each consumer while the consumer is using any Google product or browsing third-party sites that have partnered with Google to
serve targeted ads.
Before March 1, 2012, information collected in one Google product was not automatically commingled with information collected during the consumer's use of other Google products. Google did not, for instance, ordinarily and automatically associate a consumer's Gmail account (and therefore his or her name and identity, his or her private contact list, or the contents of his or her communications) with the consumer's Google search queries or the consumer's use of other Google products like Android, YouTube, Picasa, Voice, Google, Maps, Docs, and Reader.
On March 1, 2012, however, Google replaced those policies with a single, unified policy that allows Google to comingle user data across accounts and disclose it to third-parties for advertising purposes. Plaintiffs, who each either acquired a Google account or purchased an Android-powered device before or on February 29, 2012, were not pleased and filed this suit.
Plaintiffs' first amended complaint, filed on March 7, 2013, expanded the bounds of the alleged classes, as well as the explanations
of Plaintiffs' injuries. After Google again moved to dismiss, the court held that Plaintiffs have sufficiently plead standing, but nonetheless granted the motion because Plaintiffs did not plead sufficient facts to support any of their claims. Although Plaintiffs were granted leave to amend, the court warned " that any further dismissal [would] likely be with prejudice."  The most significant allegations added concern Google's plan entitled " Emerald Sea."  Unveiled within Google as early as May, 2010, Emerald Sea's apparent objective was " to reinvent [Google] as a social-media advertising company."  The plan's execution involves creating cross-platform dossiers of user data that would allow third-parties to better tailor advertisements to specific consumers. Plaintiffs allege that despite this objective, Google left in place the prior policies in order to avoid tipping-off consumers. They cast Emerald Sea as evidence of Google's intent to deceive consumers by disregarding existing privacy policies in pursuit of ad revenue.
With these new allegations in place, Plaintiffs allege effectively the same harms as before. The class as a whole complains that commingling and disseminating user data violates Google's prior privacy policies and constitutes an unreasonable invasion of consumer privacy. The Android Device Switch Subclass further complains that in order to avoid such an invasive policy, the class members replaced their Android devices and incurred costs in doing so. Additionally, the Android Application Disclosure Subclass claims Google's disclosures to third parties caused increased battery and bandwidth consumption as well as invasions of Plaintiffs' statutory and common law privacy rights. Plaintiffs frame these complaints within six legal theories: violations of the California Consumers Legal Remedies Act (" CLRA" ), Federal Wiretap Act, Stored Electronic Communications Act, California's Unfair Competition Law (" UCL" ), and common law theories of breach of contract and intrusion upon seclusion.
Google now moves to dismiss this case once and for all, again arguing that Plaintiffs' lack standing and have failed to plead facts sufficient to substantiate their claims.
II. LEGAL STANDARDS
A. Article III Standing
To satisfy Article III, a plaintiff " must show that (1) it has suffered an 'injury in fact' that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision."  A suit brought by a plaintiff without Article III standing is not a " case or controversy," and an Article III court lacks subject matter jurisdiction over the suit. In that event, the suit should be dismissed under Fed. R. Civ. Pro. 12(b)(1).
The injury required by Article III may exist by virtue of " statutes creating legal rights, the invasion of which creates standing."  In such cases, the " standing question . . . is whether the constitutional or standing provision on which the claim rests properly can be understood as granting persons in the plaintiff's position a right to judicial relief."  At all times the threshold question of standing " is distinct from the merits of [a] claim" and does not require " analysis of the merits."  The Supreme Court also has instructed that the " standing inquiry requires careful judicial examination of a complaint's allegations to ascertain whether the particular plaintiff is entitled to an adjudication of the particular claims asserted." 
B. Rule 12(b)(6)
A complaint must contain " a short and plain statement of the claim showing that the pleader is entitled to relief."  If a plaintiff fails to proffer " enough facts to state a claim to relief that is plausible on its face," the complaint may be dismissed for failure to state a claim upon which relief may be granted. A claim is facially plausible " when the pleaded factual content allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged."  Accordingly, under Fed.R.Civ.P. 12(b)(6), which tests the legal sufficiency of the claims alleged in the complaint, " [d]ismissal can
be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory."  " A formulaic recitation of the elements of a cause of action will not do." 
On a motion to dismiss, the court must accept all material allegations in the complaint as true and construe them in the light most favorable to the non-moving party. The court's review is limited to the face of the complaint, materials incorporated into the complaint by reference, and matters of which the court may take judicial notice. However, the court need not accept as true allegations that are conclusory, unwarranted deductions of fact, or unreasonable inferences.
" Dismissal with prejudice and without leave to amend is not appropriate unless it is clear . . . that the complaint could not be saved by amendment." 
As in prior motions, Google attacks Plaintiffs' operative complaint on two fronts. First, it argues that Plaintiffs lack standing to bring their claims at all. Second, it argues that even if they have standing, Plaintiffs have once again failed to plead their claims in more than a conclusory manner, such that they must be dismissed under Iqbal and Twombly.
In its earlier order, the court explained that Plaintiffs had standing to raise their claims based on: (1) the greater discharge of battery power and system resources due to unauthorized activity; (2) the costs incurred by each named plaintiff when he bought a new phone after the policy change, since his initial phone choice was substantially driven by privacy concerns; (3) the injury incurred overpaying for Android devices based on Google's misrepresentation about certain features; (4) violation of statutory rights bestowed by the Wiretap Act; (5) violations of statutory rights bestowed by the Stored Communications Act and (6) violations of statutory rights bestowed by Cal. Civ. Code § 3344. In light of the claims Plaintiffs now pursue, only the first two reasons remain pertinent. Google argues that those two do not give rise to Article III standing and that all of Plaintiffs' other injury theories " fail anew for the same reasons they failed last time."  Google separately argues Plaintiffs' standing based on an alleged risk of future harm from data commingling and disclosure to third parties is insufficient. As explained below, while the latter argument is persuasive, the former arguments are not.
1. Alleged Heightened Risks of Future Harms Do Not Confer Standing
Google initially challenges the Application Disclosure subclass' standing to bring
its claims for unfair competition and intrusion upon seclusion. Google argues that the heightened security risk Plaintiffs allege as a result of their data being disclosed to app developers does not amount to Article III injury-in-fact. Indeed, this court's prior order held that unauthorized disclosure in and of itself did not confer standing. In response to that order, however, Plaintiffs have expanded their allegations to explain that the relevant injury is not the mere unauthorized disclosure of user data, but rather the fact that such disclosure exposes users " to a substantially increased, unexpected, and unreasonable risk of further interception or dissemination of their personal information as well as of other adverse consequences, including harassment, receipt of unwelcome communications, and identity theft." 
The Ninth Circuit has recognized that the improper disclosure of personal information can give rise to standing based on the threat of future harm so long as that harm is credible, real, and immediate, and not merely conjectural or hypothetical. But establishing such a credible, real, and immediate harm is no small feat. For example, in Low v. LinkedIn, the court found no such harm, even where a digital service provider was alleged to have disclosed information to (un)authorized third-parties. Similarly, in Yunker v. Pandora, the court found insufficient harm to confer standing where the defendant, a music service provider, shared personal information without anonymizing it. Each of these courts concluded that the alleged risk of future harm posed by the defendant's conduct was too conjectural and hypothetical to fall within the scope of
the Ninth Circuit's standard.
The alleged threat of future harm in this case is similarly conjectural. The information disclosure is markedly distinguishable from that in Krottner : there, disclosure was a result of laptop theft containing sensitive personal information of almost 100,000 Starbucks employees. Here, no criminal activity is alleged to have been involved. Google's authorized third-party disclosure not only differentiates this case from Krottner, but also brings it in line with Low and Yunker.
2. Plaintiff Nisenbaum's Phone Replacement Still Confers Standing
3. Battery Depletion Confers Standing
Google's third substantive argument against standing attacks the alleged injury to Plaintiffs' battery life caused by Google Play's unauthorized transmission of their information when they download an app. As in previous complaints, the App Disclosure subclass has asserted breach of contract and unfair competition, based on the injury caused by decreased battery life. Google argues that the claims giving rise to that injury are " now gone," and that there is now " no nexus between the claimed violation (Google Play disclosing account information to developers) and the claimed injury (battery use)."  Google's reasoning is that app developers access user data from Google Play's servers, not the user's individual phones, and therefore such optional access does not implicate phone battery consumption.
Google's argument here--challenging the causal nexus between its alleged conduct and the Plaintiffs' alleged injury--requires a heavily and inherently fact-bound inquiry that the court may not reach at this stage in the litigation. Google also concedes that its disclosure of user data causes the phones to send at least " a few bytes of name, email address, and zip code information."  Moreover, the court has already ruled that allegations of resource depletion, including battery power, gives rise to standing, and the App Disclosure subclass has alleged resource depletion stemming from Google's breach of contract and the UCL. Whatever their ultimate merits, the subclass plainly has standing to raise those claims.
B. Sufficiency of the Pleadings
With the standing question resolved, the court next turns to the legal sufficiency of the claims alleged. At the outset, it is worth noting that this court's prior order found that Google is immune from the claims alleged under the Wiretap Act because of its status as a provider of electronic communication services, and Plaintiffs have not amended or altered their claim to avoid that immunity in this iteration. Similarly, the court's prior order
determined that Google is not subject to liability under the Stored Communications Act based on the conduct alleged, and again, Plaintiffs have not amended their claim to suggest a different result. The breach of contract claim on behalf of the entire class falls for the same reason. While Plaintiffs have successfully preserved these issues for appellate review, they are once again dismissed for failure to state a claim in the current proceeding.
1. CLRA Claim on Behalf of Device Switch Subclass
Plaintiffs try to dodge this flaw in their claim with three arguments. First, they argue that " CLRA jurisprudence is abundantly clear that the reliance element is satisfied with allegations that 'the plaintiff 'in all reasonable probability' would not have engaged in the injury-producing conduct' absent the misrepresentation or omission."  This argument is problematic for several reasons, but the most glaring
is that every case Plaintiffs cite in its support concerns the UCL, not the CLRA. Furthermore, in two of those three cases, the plaintiff had clearly alleged that he or she was exposed to the misrepresentation, and the parties were simply fighting about whether the complaint spelled out that the plaintiff had relied on it in deciding to pursue the injury-inducing conduct. This complaint lacks the predicate allegation (exposure), which precludes the court from considering reliance. Second, Plaintiffs argue that reliance may be presumed from a material omission. That is certainly true in a case based on a theory of non-disclosure, but here, Plaintiffs theory is that they made their purchasing decision based on affirmative, fraudulent representations. Third, Plaintiffs argues that the court can and should reasonably infer that " Nisenbaum was exposed to the 2008 Android Policy or 2009 Mobile Policy terms during the registration process" for his Android account. However, that exposure would not have occurred until " after [Nisenbaum purchased] his Android device,"  at which point, it would not be reasonable to infer that Nisenbaum relied on the policy in deciding to purchase the device.
In short, although it was properly directed at Google, the Device Switch Subclass' CLRA claim must be dismissed once again based on deficient pleadings.
2. UCL Claim on Behalf of Device Switch Subclass
California's UCL provides a private cause of action for users who are harmed by unfair, unlawful, or fraudulent business practices. Plaintiffs plead their UCL claim under all three prongs. To sustain a claim under the unlawful prong, Plaintiffs must allege facts that, if proven, would demonstrate that Defendant's conduct violated another, underlying law. If the unlawful conduct is part of a uniform course of fraudulent conduct, it must meet Rule 9(b)'s heightened pleading standards. Under the fraudulent prong, Plaintiffs must allege specific facts to show that the members of the public are likely to be deceived by the actions of the defendant. The Ninth Circuit has established that this prong always is subject to Fed. Rule Civ. P. 9(b)'s heightened pleading requirements. With respect to Plaintiffs' claim under the UCL's unfair prong, " [t]he standard for determining what business acts or practices are 'unfair' in user actions under the UCL is currently unsettled."  Generally speaking, " [a]n unfair business practice under the UCL is " one that either offends an established public policy or is immoral, unethical, oppressive, unscrupulous, or substantially injurious to users."  To determine whether a business practice is unfair, a court should consider " the impact of the practice or act on its victim, balanced against the reasons, justifications and motives of the alleged wrongdoer; " this prong of the UCL should be used to " enjoin deceptive or sharp practices." 
Plaintiffs' claim under the unlawful prong of the UCL is based entirely on their CLRA claim. As the CLRA claim fails, so does the derivative UCL claim. Plaintiffs' claim under the fraudulent prong of the UCL also fails for the same
reason that the CLRA claim failed: the complaint does not allege reliance.
Plaintiffs' claim under the unfair prong of the UCL fails as well, but for a different reason. Their unfairness theory is best understood in a three-step syllogism: (1) Plaintiffs have a right to privacy under the California Constitution; (2) Google's conduct " resulted in a violation of" that right to privacy, therefore (3) Google's conduct ran afoul of the UCL. Contrary to Google's suggestion that the harms alleged in this claim are the same as they were in the previous iterations, this framework offers a new and different theory of recovery. Unfortunately for Plaintiffs, it is no more successful. A necessary piece of the theory is that Google's conduct violated Plaintiffs' right to privacy under the California Constitution, yet they have not alleged facts to support that assertion. To prove a claim under the California Constitutional right to privacy, a plaintiff must plead three elements: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious, egregious invasion of the protected privacy interest. Even if Plaintiffs have sufficiently alleged the first two elements, they have not met the third. Courts in this district have consistently refused to characterize the disclosure of common, basic digital information to third parties as serious or egregious violations of social norms. The conduct at issue in this case is neither sufficiently different from prior cases nor sufficiently beyond the pale of social norms to justify such a characterization here.
As the theories of harm fail under all three prongs of the UCL, the Device Switch Subclass' claim under the UCL is dismissed.
3. Breach of Contract Claim on Behalf of App Disclosure Subclass
Plaintiffs' third through fifth causes of action are brought on behalf of the App Disclosure subclass. The first is the breach of contract claim, which underlies this subclass' other claims.
" Under California law, the elements of a breach of contract claim are: (1) the existence of a contract, (2) plaintiff's performance or excuse for nonperformance, (3) defendant's breach, and (4) resulting damage to plaintiff."  The
court's prior order dismissed Plaintiffs' breach of contract claim because an express provision in the contract at issue allowed data commingling. The complaint now adequately states a claim for breach of contract solely on behalf of the Android App Disclosure Subclass. The complaint alleges: (1) that the subclass " entered into a contract with Google by registering for an Android Market/Google Play account, the key terms of which were provided in the relevant terms of service and privacy policies,"  (2) the specific terms at issue;  (3) that Google breached those terms by disclosing user data to third parties following every download or purchase of an app and (4) resulting damages in the form of resource consumption.
4. Intrusion Upon Seclusion Claim on Behalf of App Disclosure Subclass
As the court previously admonished Plaintiffs, to assert an intrusion upon seclusion claim, a plaintiff must plead facts in support of two elements: " 1) intrusion into a private place, conversation or matter, and 2) in a manner highly offensive to a reasonable person. . . . To show intrusion, a plaintiff must have 'an objectively reasonable expectation of seclusion or solitude in the place, conversation or data source,' and the defendant must have 'penetrated some zone of physical or sensory privacy surrounding, or obtained unwanted access to data about, the plaintiff.'"  In this context, " the concept of 'seclusion' is relative. The mere fact that a person [or their information] can be seen by someone does not automatically mean that he or she can legally be forced to be subject to being seen by everyone."  Courts have recognized facts sufficient to support these elements in the context of repeated phone calls, eavesdropping on workplace conversations, and unauthorized email review.
Google argues that the court should simply stick with its prior holding that commingling of user data is an inadequate allegation for an intrusion claim. But to so rule would fail to recognize Plaintiffs' new theory: that the intrusion at issue is disclosure to third-party developers contrary to Google's own policies.
The court nonetheless cannot find that Plaintiffs have stated a claim under their revised theory either. This district " set[s] a high bar" for the requisite " intrusion [that is] highly offensive to a reasonable person."  Just as In re iPhone Application Litig.'s analogous facts were informative on the issue of standing, they also teach here that Plaintiffs' allegations do not plausibly rise to the level of intrusion necessary to establish an intrusion claim. Plaintiffs' intrusion claims are therefore dismissed.
5. UCL Claim on Behalf of App Disclosure Subclass
Plaintiffs' fifth cause of action is another UCL claim, this time on behalf of the App Disclosure subclass. The App Disclosure subclass seeks recovery under two of the three prongs of the UCL, one of which is easily disposed of by this court's prior order. Their theory under the unfair prong of the UCL is that members of the App Disclosure subclass were lured into believing that their personal information would be closely guarded while Google encouraged them to " make Android devices and applications indispensable to their lives; " they were therefore trapped when Google implemented policies " from which they cannot effectively opt out."  In its last order, the court found that the " benefit to users in receiving free, 'indispensable services' offsets much of the harm they may suffer" as a result of being subjected to the changed policies. Plaintiff presents no persuasive reason to alter that holding here. As such the unfair prong of the App Disclosure subclass' UCL claim fails.
and download Android applications. Finally, Plaintiffs plead that they have suffered the loss of battery power and other system resources as a result of Google's fraudulent and surreptitious conduct. Once again, whatever the ultimate merits of this claim, the App Disclosure Subclass has stated a claim for relief that may go forward.
After running each claim (and subclaim) of each class (and subclass) through the gauntlet of constitutional and procedural hurdles, two claims remain: the App Disclosure Subclass' breach of contract claim, and the fraudulent prong of the App Disclosure Subclass' UCL claim. Plaintiffs may proceed on these two causes of action alone. Because the court warned Plaintiffs in its last order that any future dismissal would likely be with prejudice, and because the thorough nature of the allegations presented persuades the court that any and all omissions were intentional, all other causes of action dismissed in this order are dismissed with prejudice and without leave to amend. It is time for this case to move forward.
IT IS SO ORDERED.