Summary
In Garcia v. Enter. Holdings, Inc., 78 F. Supp. 3d 1125, 1131 (N.D. Cal. 2015), plaintiff alleged privacy violations and the hyperlink to the "Privacy Policy" at issue was in the same text box as the "Okay" button for completing registration through Facebook, putting plaintiff on notice of the Privacy Policy terms.
Summary of this case from Berman v. Freedom Fin. Network, LLCOpinion
Case No: C 14–00596 SBA
2015-01-23
Miguel Garcia, individually and on behalf of all others similarly situated, Plaintiff, v. Enterprise Holdings, Inc., d/b/a Zimride, a Missouri corporation, and Lyft Inc., a Delaware corporation, Defendant.
Benjamin Scott Thomassen, Chandler Randolph Givens, Jack D. Yamin, Jay Edelson, Rafey S. Balabanian, Edelson McGuire, LLC, Chicago, IL, Mark Stephen Eisen, Edelson PC, Los Angeles, CA, Samuel Lasser, Law Office of Samuel Lasser, San Francisco, CA, for Plaintiff. J. Daniel Sharp, Crowell & Moring LLP, Rachael Elizabeth Meny, Jennifer Ann Huber, Michelle Sabrina Ybarra, Keker & Van Nest LLP, San Francisco, CA, for Defendant.
Benjamin Scott Thomassen, Chandler Randolph Givens, Jack D. Yamin, Jay Edelson, Rafey S. Balabanian, Edelson McGuire, LLC, Chicago, IL, Mark Stephen Eisen, Edelson PC, Los Angeles, CA, Samuel Lasser, Law Office of Samuel Lasser, San Francisco, CA, for Plaintiff. J. Daniel Sharp, Crowell & Moring LLP, Rachael Elizabeth Meny, Jennifer Ann Huber, Michelle Sabrina Ybarra, Keker & Van Nest LLP, San Francisco, CA, for Defendant.
ORDER GRANTING DEFENDANTS' MOTION TO DISMISS
Dkt. 33
SAUNDRA BROWN ARMSTRONG, District Judge
Plaintiff Miguel Garcia (“Plaintiff”) brings the instant putative class action against defendants Enterprise Holdings Inc. (“Enterprise”) and Lyft, Inc. (“Lyft”), which are the present and former owners, respectively, of an internet-based ride sharing application known as “Zimride.” Plaintiff alleges each time he used Zimride, it automatically disclosed his personal information to a third-party, Mixpanel, in violation of the California Invasion of Privacy Act (“CIPA”), Cal. Pen.Code § 637.6 (“Section 637.6”). The Court has subject matter jurisdiction under the Class Action Fairness Act. See28 U.S.C. § 1332(d).
The parties are currently before the Court on the Motion to Dismiss Class Action Complaint jointly filed by Defendants Enterprise and Lyft, pursuant to Federal Rule of Civil Procedure 12(b)(6). Having read and considered the papers filed in connection with this matter and being fully informed, the Court hereby GRANTS the motion, and dismisses the First Amended Complaint (“FAC”) with leave to amend. The Court, in its discretion, finds this matter suitable for resolution without oral argument. See Red. R. Civ. P. 78(b); N.D. Cal. Civ. L.R. 7–1(b).
I. BACKGROUND
A. Plaintiff's Allegations
Launched in 2007, Zimride is a popular on-line ride-sharing application which matches Zimride members seeking rides with other members willing to offer rides. First Am. Compl. (“FAC”) ¶ 2.
The service, which is marketed heavily to college students through partnerships with various universities, has over 350,000 subscribers and is one of the largest carpooling and ridesharing services in the United States. Id. ¶¶ 2, 12.
In 2013, Enterprise acquired Zimride from Lyft. FAC ¶ 13.
To use Zimride, a user must first navigate to the application's website ( www.zimride.com ), and then enter a starting point, a destination, and the desired date and time of departure. Id. ¶ 14 (citing Figure 1, below).
IMAGE
In order to search for existing rides or to post a new ride, the user is prompted to sign in to his or her Facebook account. If the user does not have a Facebook account, the user is prompted to sign up for one. Id. ¶ 15 (citing Figure 2, below).
IMAGE
During the sign-up process, a pop-up dialogue box appears which informs the user as follows: “Zimride will receive the following info: your public profile, friend list, email address, birthday, work history, education history, events, hometown, interests, current city, personal description and likes.” Id. ¶ 16 (citing Figure 3, below).
IMAGE
According to Plaintiff, Zimride is “designed” to transmit the user's personal information to Mixpanel after that information is entered by the user. Id. ¶ 19. The information sent to Mixpanel consists of the user's gender, age, zip code, metropolitan region, travel plans, link to the user's Facebook profile and unique alphanumeric identifier. Id. Mixpanel is identified as “a third party data analytics company” which allegedly uses consumers' personal information to “compile comprehensive profiles of consumers' entire digital lives,” which can then be “sold as a commodity.” Id. ¶ 14. However, there are no allegations in the FAC regarding the reason Zimride transfers information to Mixpanel.
Plaintiff signed up to use Zimride in July 2012. Id. ¶ 31. Thereafter, he submitted ride requests in August 2012 and again in May and December 2013. Each time, his personal information was allegedly transmitted to Mixpanel. Id. ¶¶ 31–34.
B. Zimride's Terms of Service and Privacy Policy
Use of Zimride is subject to its Terms of Service (“TOS”) and Privacy Policy. See Defs.' Request for Judicial Notice at 2, Dkt. 35. The TOS states, in part:
THIS FOLLOWING USER AGREEMENT DESCRIBES THE TERMS AND CONDITIONS ON WHICH ZIMRIDE, INC. OFFERS YOU ACCESS TO OUR SERVICES ... [¶] IF YOU DO NOT AGREE TO BE BOUND BY THE TERMS AND CONDITIONS OF THIS AGREEMENT, PLEASE DO NOT USE OR ACCESS OUR SERVICES OR REGISTER FOR THE SERVICES PROVIDED ON THIS SITE.
See Ybarra Decl., Exs. D–F, Dkt. 36. The TOS includes a Privacy Policy, which states, inter alia, that Zimride may disclose a user's personal information to third-parties in connection with providing ride-sharing services:
To operate the Site, including processing your transactions and supporting your activities on the Site, we may share your personal information with our agents, representatives, contractors and service providers so they can provide us with support services such as email origination, receipt or support services, customer relationship management services, and order fulfillment. We require these entities not to use your information for any other purpose.... By using the site, you do hereby represent and warrant that you have read understand and agree to all terms of this Privacy Policy and Terms of Service.
See id., Ex. D at 1, 12; Ex. E at 1, 12; and Ex. F at 1, 7 (emphasis added).
Hyperlinks to both the TOS and Privacy Policy are located at the bottom of the Facebook log-in screen. To the right of the hyperlinks is an “Okay” button, which the user must click on in order to complete the sign up process. The webpage shown to the user appears as follows:
IMAGE
Ybrarra Decl. Ex. C.
This screenshot appears as Figure 3 in the FAC, except that Plaintiff's depiction omits the bottom part of the screen which shows the hyperlinks and Okay button. Although Plaintiff does not dispute the authenticity of the screenshots, TOS and Privacy Policy submitted by Defendants, he argues that the Court cannot consider them on a motion to dismiss. That issue will be resolved below.
C. Procedural History
Plaintiff filed his original Complaint in this Court on February 7, 2014, and a First Amended Complaint (“FAC”) on March 28, 2014. Dkt. 1, 29. The FAC alleges a single claim for violation of Section 637.6, which is part of the CIPA. FAC ¶¶ 43–47. In response, Defendants have filed a motion to dismiss for failure to state a claim. The motion is fully briefed and is ripe for adjudication.
II. LEGAL STANDARD
A. Motions to Dismiss
Pleadings in federal court actions are governed by Federal Rule of Civil Procedure 8(a)(2), which requires “a short and plain statement of the claim showing that the pleader is entitled to relief.” Rule 12(b)(6) “tests the legal sufficiency of a claim.” Navarro v. Block, 250 F.3d 729, 732 (9th Cir.2001). A complaint may be dismissed for either failure to state a cognizable legal theory or insufficient facts to support a cognizable legal theory. Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir.2008). The court is to “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Outdoor Media Group, Inc. v. City of Beaumont, 506 F.3d 895, 899–900 (9th Cir.2007). While a court considering a Rule 12(b)(6) motion is generally limited to considering the contents of the complaint, “it may consider documents on which the complaint necessarily relies and whose authenticity ... is not contested.” Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1141 n. 5 (9th Cir.2003) (internal quotation marks and citation omitted) (alteration in original).
To survive a motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). The complaint must afford the defendants “fair notice” of the claims against them, and the grounds upon which the claims are based. Swierkiewicz v. Sorema N.A., 534 U.S. 506, 512, 122 S.Ct. 992, 152 L.Ed.2d 1 (2002). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. When a complaint or claim is dismissed, “[l]eave to amend should be granted unless the district court determines that the pleading could not possibly be cured by the allegation of other facts.” Knappenberger v. City of Phoenix, 566 F.3d 936, 942 (9th Cir.2009).
B. Statutory Interpretation
A federal court interpreting a state statute follows that state's rules of statutory construction. Turnacliff v. West l y, 546 F.3d 1113, 1117 (9th Cir.2008). Under California law, “the ultimate task” of statutory construction is “to ascertain the Legislature's intent.” People v. Massie, 19 Cal.4th 550, 79 Cal.Rptr.2d 816, 967 P.2d 29 (1998). “California courts look first to the text of the statute, 'giving to the language its usual, ordinary import and according significance, if possible to every word, phrase and sentence in pursuance of the legislative purpose.” Garcia v. Pacifi C are of California, Inc., 750 F.3d 1113, 1116 (9th Cir.2013) (citing State Farm Mut. Auto. Ins. Co. v. Garamendi, 32 Cal.4th 1029, 12 Cal.Rptr.3d 343, 88 P.3d 71 (2004)). If the language of the statute is clear and unambiguous, the statutory analysis ends.” Viceroy Gold Corp. v. Aubry, 75 F.3d 482, 490 (9th Cir.1996) (citing Delaney v. Superior Court, 50 Cal.3d 785, 268 Cal.Rptr. 753, 789 P.2d 934 (1990)). In cases where the statutory language is ambiguous, courts may look to the statute's legislative history for guidance. Kaufman & Broad Cmtys., Inc. v. Performance Plastering, Inc., 133 Cal.App.4th 26, 29, 34 Cal.Rptr.3d 520 (2005).
III. DISCUSSION
A. Overview of the CIPA
The CIPA was enacted in 1967 “to protect the right of privacy of the people of this state.” Cal. Pen.Code § 630. The California Legislature declared that with the advent of new devices and technology used “for the purposes of eavesdropping upon private communications,” the resulting invasion of privacy from the “use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.” Id. To address that concern, the CIPA, inter alia, bars various acts of eavesdropping upon, intercepting, or recording communications. E.g., id. §§ 631, 632, 632.5, 632.6, 632.7. The CIPA imposes both criminal and civil liability for violations of its provisions. Id.
In 1990, the Legislature amended the CIPA by adding Section 637.6 to protect against the disclosure of information acquired to establish or implement carpooling or ridesharing programs. This amendment was prompted by the proliferation of “private and public ridesharing companies” and the corresponding “need ... to protect the confidentiality of the information these companies have access to or acquire.” Defs.' RJN, Ex. I (Assembly Committee on Public Safety, Analysis of AB 3984 (1989–1990 Reg. Sess.) at 2). In the course of establishing rideshare lists, Caltrans and some of its department offices had obtained and shared personal information of potential riders with outside rideshare agencies. Id. (Business Transportation and Housing Agency, Legislative Analysis of AB 3984 (1989–1990 Reg. Sess.) at 4). To ensure that the use and dissemination of a rider's personal information were limited to the establishment of ridesharing programs, the Legislature, with the assistance of a Caltrans rideshare contractor, drafted legislation that was eventually enacted as Section 637.6. Id.
The final version of the bill included an amendment to make clear that a participant's personal information could lawfully be disclosed upon his or her consent. Id. Ex. J (Business Transportation and Housing Agency, Enrolled Bill Rep. on Assem. Bill No. 3984 (1989–1990 Reg. Sess.) prepared for Gov. Deukmejian (July 8, 1990) at 1). Section 637.6 provides as follows:
(a) No person who, in the course of business, acquires or has access to personal information concerning an individual, including, but not limited to, the individual's residence address, employment address, or hours of employment, for the purpose of assisting private entities in the establishment or implementation of carpooling or ridesharing programs, shall disclose that information to any other person or use that information for any other purpose without the prior written consent of the individual.
(b) As used in this section, “carpooling or ridesharing programs” include, but shall not be limited to, the formation of carpools, vanpools, buspools, the provision of transit routes, rideshare research, and the development of other demand management strategies such as variable working hours and telecommuting.
(c) Any person who violates this section is guilty of a misdemeanor, punishable by imprisonment in the county jail for not exceeding one year, or by a fine of not exceeding one thousand dollars ($1,000), or by both that imprisonment and fine.
Cal. Pen.Code § 637.6 (emphasis added).
B. Contentions
In their motion to dismiss, Defendants contend that: (1) they are not proper parties under Section 637.6 because neither of them is a “person” as defined therein; (2) they are not alleged to have engaged in conduct proscribed by the statute; and (3) Plaintiff's allegations regarding lack of consent are deficient.
The Court discusses these issues seriatim.
In a footnote, Defendants argue that Plaintiff has failed to allege that he suffered an injury-in-fact, but abandons that argument in its reply. In any event, the Ninth Circuit has held under a plaintiff may establish injury-in-fact based on a statutory violation. Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir.2010).
1. Proper Defendant
To be held liable under Section 637.6, a party must be a “person” as defined in Section 637.6. That person must be one (a) who acquires or has access to an individual's personal information (b) for the particular purpose of assisting a private entity establish a rideshare or carpooling program. Cal. Pen.Code § 637.6(a). Defendants present several arguments why they are not proper parties.
As an initial matter, Defendants assert that there are no allegations showing that they were “assisting private entities” in the establishment of a carpool or rideshare program. Cal. Pen.Code § 637.6(a). The Court agrees. The pleadings allege only that Zimride automatically shares a user's personal information with Mixpanel; they do not allege that Defendants engaged in any particular conduct aimed at providing assistance to a private entities. Indeed, as Plaintiff now confirms, Defendants are the private entities that established the Zimride ridesharing platform as opposed to the persons who assisted the private entities. See Pl.'s Opp'n at 4, Dkt. 40.
In his opposition, Plaintiff now takes the position that Defendants' employees are the “persons” who obtained his personal information, which they, in turn, provided to Defendants, i.e., the private entities. Id. Relying on the doctrine of respondeat superior, Plaintiff posits that Defendants are vicariously liable for the conduct of their employees and therefore are proper parties. Id. This theory of liability is not alleged in the FAC, and as such, is not properly before the Court. See Schneider v. Calif. Dep't of Corrections, 151 F.3d 1194, 1197 n. 1 (9th Cir.1998) (“ ‘new’ allegations contained in the [plaintiff]'s opposition ... are irrelevant for Rule 12(b)(6) purposes.”).
Even if it were pled, Plaintiff's construction of Section 637.6 is untenable. In Plaintiff's view, a private entity—through its employees—is deemed to assist itself. As a result, there is effectively no difference between a “person” and “private entity.” In addition, if Section 637.6 were construed in that manner, the phrase “for the purpose of assisting private entities” would be superfluous, which is contrary to the rules governing statutory construction. See Klein v. United States of Am., 50 Cal.4th 68, 80, 112 Cal.Rptr.3d 722, 235 P.3d 42 (2010) (“courts must strive to give meaning to every word in a statute and to avoid constructions that render words, phrases, or clauses superfluous.”). The Court therefore rejects Plaintiff's contention that Defendants may be held liable as “persons” based on the doctrine of respondeat superior.
The above notwithstanding, the Court is unpersuaded by Defendants' remaining contentions. Defendants claim that Zimride is not a “carpooling or ridesharing program” as defined by Section 637.6. Defs.' Mot. at 7–8. Under the statute, “ ‘carpooling or ridesharing programs' include, but shall not be limited to, the formation of carpools, vanpools, buspools, the provision of transit routes, rideshare research, and the development of other demand management strategies such as variable working hours and telecommuting.” Cal. Pen.Code § 637.6(b). Defendants assert that Section 637.6 was intended to regulate “commuter carpooling,” and not the “occasional road trip” facilitated by Zimride. However, the statute does not limit its application to “commuter” carpools nor does it exclude “occasional” ridesharing. See People v. Standish, 38 Cal.4th 858, 869, 43 Cal.Rptr.3d 785, 135 P.3d 32 (2006) (noting that the intent of a statute should be ascertained in the first instance from “the language of the statute itself).
The Court is likewise unpersuaded by Defendants' argument that they did not “acquire[ ]” or “ha[ve] access to personal information” because Plaintiff “directly and knowingly entered his personal information onto the Zimride platform.” Defs.' Mot. at 7, Dkt. 34. Section 637.6 only requires that a person “acquire[ ] or has access to” an individual's personal information. Application of the statute is not dependent on how that person acquires or has access to that information. Although the pleadings are not a model of clarity, it is reasonable to infer that Defendants, by virtue of their ownership of Zimride, either acquired or has access to Plaintiff's personal information. That Plaintiff voluntarily provided his information in the course of using Zimride is inapposite.
2. Prohibited Conduct
Defendants next argue that even if they are subject to Section 637.6, Plaintiff has not alleged facts showing that they engaged in conduct prohibited by the statute; namely, the unauthorized disclosure of personal information to a third party. Section 637.6 defines personal information as “including, but not limited to, the individual's residence address, employment address, or hours of employment, ...” Cal. Pen.Code § 637.6(a). The legislative history indicates that, among other things, the dissemination of information regarding an individual's travel plans could make him or her a target of residential burglars. RJN Ex. J, Dkt. 36–9 at 14. Similarly, the unauthorized disclosure of an individual's personal information could subject that person to unwanted solicitations. Id.
Defendants attempt to make much of the fact that the pleadings do not allege the disclosure of Plaintiff s home or work address or work hours, as referenced in the statute. However, as Section 637.6 makes clear, the type of personal information listed is not intended to be exhaustive. Moreover, the type of personal information allegedly disclosed by Zimride, i.e., the user's gender, age, zip code, metropolitan region, travel plans, link to the user's Facebook profile and his or her unique alphanumeric identifier, see FAC ¶ 19, is the type of information that could be utilized by would-be criminals or marketers. Thus, the Court is satisfied that the type of information identified in the pleadings may reasonably be construed as “personal information” for purposes of Section 637.6.
The Court, however, agrees with Defendants' contention that Plaintiff has failed to allege that either they or Zimride disclosed Plaintiff's personal information to Mixpanel for any purpose other than establishing or implementing a rideshare or carpooling program. There are no facts in the FAC regarding the reason Zimride transmits a user's information to Mixpanel. The only allegations pertaining to Plaintiff's personal information are that information was submitted to Zimride, which, in turn, disclosed his information to Mixpanel. FAC ¶ 19. Since there are no allegations that Mixpanel used—or that Defendants provided it with—Plaintiff's personal information for any purpose prohibited by Section 637.6, Plaintiff's claim must fail.
3. Lack of Consent
Finally, Defendants contend that Plaintiff's allegations regarding lack of consent are inadequate. The pleadings allege that while Plaintiff was advised that Zimride would receive certain of his personal information, he was neither informed of nor consented to the transmission of his personal information to Mixpanel. Id. ¶¶ 16, 18, 33, 34, 46. In response to Defendants' challenge to the sufficiency of those allegations, Plaintiff makes two arguments. First, he asserts that lack of consent is an affirmative defense and not an elements of his claim, and therefore, Defendants cannot raise the issue on a motion to dismiss. Opp'n at 12. Second, Plaintiff claims that to the extent lack of consent must be pled, he has sufficiently alleged as much in the FAC. Id. Neither argument is compelling.
As an initial matter, the Court disagrees with Plaintiff's assertion that lack of consent is not an element of his claim. Section 637.6 specifically prohibits the disclosure and use of an individual's personal information “without the prior written consent of the individual.” Cal. Pen.Code. § 637.6(a) (emphasis added). Where lack of consent is an express element of a claim, as is the case here, it must be alleged in the complaint. See Maxwell v. Dolezal, 231 Cal.App.4th 93, 97, 179 Cal.Rptr.3d 807 (2014) (finding that lack of consent must be alleged in a statutory invasion of privacy claim under California Civil Code section 3344, a statute that prohibits the commercial use of a person's name or likeness “without such person's prior consent”). As such, the Court finds that Defendants may properly challenge Plaintiff's allegations regarding lack of consent through the instant motion to dismiss.
Plaintiff's citation to Heinrichs v. Wells Fargo Bank, N.A., No. C 13–05434 WHA, 2014 WL 985558, at *2 (N.D.Cal. Mar. 7, 2014) for the proposition that lack of consent is an affirmative defense is misplaced. Heinrichs involved a claim under the Telephone Consumer Protection Act, a statute in which lack of consent is not an element of a claim. Because consent is an exemption to liability under the statute, the district court concluded that consent is an affirmative defense. Id. In contrast, under Section 637.6, no liability can attach unless lack of consent is established in the first instance.
The Court likewise rejects Plaintiff's second contention that his allegations are sufficient. Though Plaintiff denies having conferred his consent, the Court need not accept as true any allegations contradicted by “matters properly subject to judicial notice or by exhibit” or “that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Sciences Sec. Litig., 536 F.3d 1049, 1055 (9th Cir.2008) (citation and internal quotations omitted). Here, the documents proffered by Defendants establish that in order to sign up for and use Zimride, a user must agree to the TOS and Privacy Policy. The Privacy Policy expressly states that “we may share your personal information with our agents, representatives, contractors and service provider” and that [b]y using the site, you do hereby represent and warrant that you have read, understand and agree to all terms of this Privacy Policy and Terms of Service.” See Ybarra Decl., Ex. D at 1, 12; Ex. E at 1, 12; and Ex. F at 1, 7. Those provisions contradict Plaintiff's claim that he was unaware of and did not consent to the transfer of his personal information to a third party.
Though Plaintiff does not dispute the accuracy or authenticity of the copies of Zimride's Privacy Policy or TOS presented by Defendants in support of their motion, he insists that the Court cannot consider them, and the Privacy Policy in particular, on the ground that his claim does not depend on their contents. Pl.'s Opp'n at 13–14. The Court disagrees. Plaintiff alleges that he signed up to use Zimride but never consented to the disclosure of his personal information. But to use Zimride, Plaintiff necessarily had to agree with Zimride's TOS and Privacy Policy, which clearly state that such information may, in fact, be disclosed. Because Plaintiff's claim necessarily depends on the application of Zimride's policies—which relate directly to the issue of consent—the Court finds that these documents may appropriately be considered on a motion to dismiss. See Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir.2005) (holding that, in connection with a motion to dismiss, the court may consider a document not attached to the pleadings where “the plaintiffs claim depends on the contents of a document, the defendant attaches the document to its motion to dismiss, and the parties do not dispute the authenticity of the document, even though the plaintiff does not explicitly allege the contents of that document in the complaint.”); Parrino v. FHP, Inc., 146 F.3d 699, 706 (9th Cir.1998), superseded by statute on other grounds as recognized in Abrego Abrego v. The Dow Chem. Co., 443 F.3d 676, 681 (9th Cir.2006) (holding that the doctrine of incorporation by reference permits the court to consider documents on a motion to dismiss that are “crucial” or “essential” to the plaintiff's claims).
As an alternative matter, Plaintiff asserts that even if the Court were to consider the Privacy Policy, he never agreed to it. See Pl.'s Opp'n at 15. Like any other agreement, the touchstone of an agreement formed on the Internet is a mutual manifestation of assent, which may be conveyed verbally, in writing or by conduct. Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1175 (9th Cir.2014). “Contracts formed on the Internet come primarily in two flavors: [1] ‘clickwrap’ (or ‘click-through’) agreements, in which website users are required to click on an ‘I agree’ box after being presented with a list of terms and conditions of use; and [2] ‘browsewrap’ agreements, where a website's terms and conditions of use are generally posted on the website via a hyperlink at the bottom of the screen.” Id. at 1175–76. Zimride's TOS and Privacy Policy are browsewrap agreements.
Plaintiff contends that Zimride policies are not binding because Zimride failed to disclose that by clicking “Okay” on the sign-up page during the on-line registration process, he was agreeing to be bound by the terms of the Privacy Policy. See Pl.'s Opp'n at 15; Ybrarra Decl. Ex. C (exemplar of sign-up screenshot, supra at 1131). However, that argument is germane to a clickwrap agreement, not a browsewrap agreement, which is at issue here. “Unlike a clickwrap agreement, a browsewrap agreement does not require the user to manifest assent to the terms and conditions expressly; rather, a party instead gives his assent simply by using the website. See Nguyen, 763 F.3d at 1176. Where a browsewrap agreement is at issue, the terms of the agreement are binding, even if the user did not actually review the agreement, provided that the user had actual knowledge of the agreement or the website put “a reasonably prudent user on notice of the terms of the contract.” Id. at 1177 (citing Specht v. Netscape Commc'ns Corp., 306 F.3d 17, 30–31 (2d Cir.2002)). In this case, there are no allegations in the pleadings regarding Plaintiff's actual or constructive knowledge of Zimride's Privacy Policy.
In sum, given the procedural posture of this case and the limited record presented, the Court does not purport to determine whether Plaintiff, in fact, consented to the Privacy Policy or to the disclosure of his personal information to Mixpanel. However, given the express provisions of the Privacy Policy and TOS, which ostensibly contradict his bare allegation that he did not consent, Plaintiff must allege additional facts to support his claim. See In re Google, Inc. Privacy Policy Litig., No. C 12–01382–PSG, 2013 WL 6248499, *13 (N.D.Cal. Dec. 3, 2013) (dismissing misappropriation of likeness claim, finding that plaintiff's “threadbare allegation that Google did not obtain their consent to use their name or likeness in advertisements associated with its ‘+1’ feature” was insufficient in light of other allegations which showed that Google fully disclosed how the feature worked). Accordingly, the Court finds that Plaintiff has failed to state a claim under Section 637.6 based on the failure to adequately allege lack of consent.
C. Leave to Amend
Although leave to amend should be given freely, courts may dismiss without leave to amend if “the allegation of other facts consistent with the challenged pleading could not possibly cure the deficiency.” Swartz v. KPMG LLP, 476 F.3d 756, 761 (9th Cir.2007) (internal quotation marks omitted). Though Plaintiff faces significant obstacles to state a plausible claim in this action, the Court will grant him an opportunity do so. Plaintiff is advised that any factual allegations set forth in his amended complaint must be made in good faith and consistent with Rule 11.
IV. CONCLUSION
For the reasons stated above,
IT IS HEREBY ORDERED THAT Defendants' Motion to Dismiss First Amended Class Action Complaint is GRANTED, and the FAC is dismissed with leave to amend. Plaintiff shall have twenty-one (21) days from the date this Order is filed to file an amended complaint, consistent with the Court's rulings. The failure to timely file the amended complaint and/or the failure to comply with this Order will result in the dismissal of the action with prejudice.
IT IS SO ORDERED.