United States District Court, N.D. California
ORDER RE MOTION TO DISMISS RE: DKT. NO. 26
DONATO United States District Judge.
a privacy class action lawsuit brought by plaintiff Brett
Heeger against defendant Facebook, Inc., on behalf of a
putative class of Facebook users who turned off
Facebook's “Location History” feature. Heeger
alleges that Facebook continued to “track, log, and
store” their private location information
“regardless of users' choices” to deactivate
that feature. Dkt. No. 1 ¶¶ 1, 43. Facebook has
moved to dismiss plaintiff's complaint under Federal
Rules of Civil Procedure 12(b)(1) and 12(b)(6). Dkt. No. 26.
The motion is granted and denied in part, with leave to
unopposed request for judicial notice, Dkt. Nos. 27, 32, is
granted, and plaintiff's fifth claim under
California's Consumer Legal Remedies Act, Cal. Civ. Code
§ 1750 et seq., is dismissed because plaintiff has
abandoned that claim to “streamline the case.”
Dkt. No. 33 at 15 n.12. That leaves four claims: (1)
violation of the California Invasion of Privacy Act
(“CIPA”), Cal. Pen. Code § 630 et seq.; (2)
violation of California's constitutional right of
privacy; (3) intrusion upon seclusion; and (4) violation of
the Stored Communications Act (“SCA”), 18 U.S.C.
§ 2701 et seq. Dkt. No. 1 ¶¶ 52-86.
ARTICLE III STANDING
says that Heeger lacks Article III standing for all of the
claims because he has not alleged a concrete and specific
injury in fact. Dkt. No. 26 at 6-9. Heeger originally filed
this lawsuit in federal court, and so he bears the burden of
establishing Article III jurisdiction. Patel v. Facebook,
Inc., 932 F.3d 1264, 1270 (9th Cir. 2019).
“[G]eneral factual allegations of injury resulting from
the defendant's conduct may suffice, and we presume that
general allegations embrace those specific facts that are
necessary to support the claim.” Id.
question is whether the intangible harm to privacy that
Heeger alleges under federal and state statutes is a concrete
injury in fact for Article III purposes. Patel v.
Facebook Inc., 290 F.Supp.3d 948, 952 (N.D. Cal. 2018).
To determine whether the violation of a statute creates a
concrete injury, the Court considers “(1) whether the
statutory provisions at issue were established to protect
[the plaintiff's] concrete interests (as opposed to
purely procedural rights), and if so, (2) whether the
specific procedural violations alleged in this case actually
harm, or present a material risk of harm to, such
interests.” Patel, 932 F.3d at 1270-71
(quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1103
(9th Cir. 2017)). History and legislative judgments
“play important roles” in the analysis.
Patel, 290 F.Supp.3d at 952. “History is
instructive because an intangible harm is likely to be
concrete for standing purposes when it bears ‘a close
relationship to a harm that has traditionally been regarded
as providing a basis for a lawsuit.'” Id.
The legislative judgments of Congress and state legislatures
are also “‘instructive and important' to our
standing inquiry.” Patel, 932 F.3d at 1273.
complaint alleges that “Facebook systematically and
covertly tracks, collects, and stores users' private
location information even after users have affirmatively
opted not to share their location history, ” Dkt. No. 1
¶ 9, and that Facebook uses this information “to
provide third party companies with targeted
advertising” for its own corporate profits.
Id. ¶ 34. That is the factual platform for the
intrusion upon seclusion claim, and the violations of the
California Constitution, CIPA and SCA.
allegations amply establish a concrete injury under Article
III. To start with the intrusion claim, Heeger states that
Facebook “intentionally intruded on [his] and class
members' solitude, seclusion, and private affairs by
continuing to track, build and store detailed location
histories without their knowledge and consent, ” Dkt.
No. 1 ¶ 71, and that Facebook exploited that information
for its own financial gain. Heeger also alleges a
“reasonable expectation of privacy in [his] mobile
device and online behavior generally, including [his]
physical locations.” Id. ¶ 69. Such
“[p]rivacy rights have long been regarded ‘as
providing a basis for a lawsuit in English or American
courts.'” Patel, 932 F.3d at 1271 (quoting
Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1549
(2016)). “The Supreme Court has likewise recognized the
common law roots of the right to privacy, ” and
“[b]oth the common law and the literal understandings
of privacy encompass the individual's control of
information concerning his or her person.” Id.
at 1272-73. Consequently, Heeger has adequately alleged an
actual and concrete invasion of his privacy rights that is
actionable in federal court under Article III.
for Heeger's privacy claim under the California
Constitution. The California Supreme Court has stated that
the “principal focus” for Article I, section 1 is
“readily discernible, ” and the ballot argument
for its passage warned “of unnecessary information
gathering, use, and dissemination by public and private
entities.” Hill v. Nat'l Collegiate Athletic
Ass'n, 7 Cal.4th 1, 21 (1994). “Informational
privacy is the core value furthered by the Privacy
Initiative, ” and the “California constitutional
right of privacy ‘prevents government and business
interests from (1) collecting and stockpiling unnecessary
information about us and from (2) misusing information
gathered for one purpose in order to serve other purposes or
to embarrass us.'” Id. at 35. Heeger has
alleged facts sufficient to state a concrete harm in light of
injuries for the CIPA and SCA claims are also actual and
concrete. “In enacting [CIPA], the Legislature declared
in broad terms its intent ‘to protect the right of
privacy of the people of this state' from what it
perceived as ‘a serious threat to the free exercise of
personal liberties [that] cannot be tolerated in a free and
civilized society.' (Pen. Code, § 630.) This
philosophy appears to lie at the heart of virtually all the
decisions construing the Privacy Act.” Ribas v.
Clark, 38 Cal.3d 355, 359 (1985). And for the Stored
Communications Act, our circuit has held that
“[b]ecause the plaintiffs allege that Facebook and
Zynga are violating statutes that grant persons in the
plaintiffs' position the right to judicial relief, we
conclude they have standing to bring this claim.”
In re Zynga Privacy Litigation, 750 F.3d 1098, 1105
n.5 (9th Cir. 2014).
there is no doubt that Heeger has the right to bring this
case in federal court. Facebook makes a last effort to avert
this conclusion by saying that the SCA and CIPA “do
not apply” to plaintiff's allegations. Dkt. No. 26
at 8. The point is not well taken. That is in effect a merits
argument, and the jurisdictional and merits inquiries are
independent. Patel, 290 F.Supp.3d at 952, 956
(“dispositive disputes on the merits should be decided
on summary judgment or at trial, and not in the Rule 12(b)(1)
jurisdictional context”) (citing Safe Air for
Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004)).
The only issue in play at this stage of this case is whether
Heeger may sue in federal court. He can. Whether he will
prevail is an entirely different question.
THE CIPA CLAIM
Heeger has a perfect right to be before the Court, the
individual counts are not sufficiently developed to go
forward. For the CIPA claim, Heeger says that Facebook
illegally used an “electronic tracking device to
determine the location or movement of a person” in
violation of California Penal Code § 637.7(a). Dkt. No.
1 ¶ 54. The problem with this proposition is that the
plain language of the CIPA does not accommodate technology
like a mobile app on a digital device, and plaintiff does not
persuasively show otherwise. Section 637.7 became law in the
late 1990s, and was expressly directed to banning the use of
an “electronic tracking device, ” which is
defined by subsection (d) as “any device attached to a
vehicle or other movable thing that reveals its location or
movement by the transmission of electronic signals.”
This language contemplates things like a freestanding GPS
unit hidden on a car, but not a downloaded Facebook app of
the sort in dispute here. In effect, the fast pace of
developments in digital technology has rendered the CIPA a
poor fit for the ...