Summary
finding that categories of the website, categories that describe the current section of the website, and referrer URL that caused navigation to the current page constituted "content"
Summary of this case from In re Meta Pixel Healthcare Litig.Opinion
Case No. 21-cv-2155-YGR
2022-06-13
IN RE GOOGLE RTB CONSUMER PRIVACY LITIGATION
ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS
Re: Dkt. No. 93
Yvonne Gonzalez Rogers, United States District Court Judge Plaintiffs Alexander Rowe, Christopher Valencia, Crystal Brown, Gary Garrett, John Kevranian, Robina Suwol, Terry Diggs, Tyler Elliot, Kimberly Woodruff, Rethena Green, Salvatore Toronto, Patrick Thompson, Christopher Johnson, Meghan Cornelius, Tara Williams, and P.W. (collectively, "plaintiffs") bring this consolidated putative class action on behalf of account holders whose personal information is allegedly sold and disseminated by defendant Google LLC through Google's Real-time Bidding process ("RTB") (Dkt. No. 92, Consolidated Class Action Complaint, "CCAC"). Plaintiffs assert eight causes of action : (1) breach of contract (Count one); (2) breach of covenant of good faith and fair dealing (Count two); (3) violation of Article 1, § 1 of the California Constitution (invasion of privacy) (Count four); (4) intrusion upon seclusion (Count five); (5) publication of private information (Count six); (6) breach of confidence (Count seven); (7) violation of the California Invasion of Privacy Act, ("CIPA"), Cal. Penal Code §§ 630 - 638 (Count eight); and (8) violation of the Electronic Communications Privacy Act ("ECPA"), 18 U.S.C. § 2511 —unauthorized interception, use and disclosure by an Electronic Communications Service (ECS) (Count ten).
Plaintiffs filed their CCAC on September 2, 2021, asserting twelve individual and class claims. (Dkt. No. 92.) In a Case Management Order dated September 2, 2021, Judge Koh directed the parties to select eight claims from the twelve claims asserted in the CCAC to be litigated through trial, with plaintiffs selecting four claims and Google selecting the other four claims. (See Dkt. No. 83 at 1.) The parties completed the process and filed a joint statement identifying the claims listed above.
Plaintiffs’ complaint includes twenty-eight exhibits totaling 500 pages, all filed as a single attachment to the complaint. (Dkt. No. 92-1.) In the future, parties shall file exhibits individually so that it is easier to locate relevant exhibits.
Currently pending is Google's motion to dismiss plaintiffs’ CCAC. (Dkt. No. 93, Motion to Dismiss, "Mot."). Having carefully reviewed the pleadings and the briefing on the motion, and for the reasons stated below, the Court hereby GRANTS IN PART AND DENIES IN PART the motion.
Pursuant to Federal Rule of Civil Procedure 78(b) and Civil Rule 7-1(b), the Court finds this motion appropriate for decision without oral argument.
I. BACKGROUND
The CCAC alleges as follows:
Google collects, observes, and analyzes data from everyone using any of its services and platforms. (CCAC ¶ 9.) This data is then disseminated and sold through Google's Real-Time Bidding system ("RTB"), which functions as an auction (Id. ¶¶ 3, 6.) Through RTB, Google solicits participants to bid on sending an ad to a specific individual ("the target"). (Id. ¶ 6.) Google provides highly specific information about the target in the bid request provided to RTB auction participants, including data that identifies the individual being targeted through unique identifiers, device identifiers, geolocation, IP address, cookie match, and other information. (Id. ) Google also provides the specific content of account holders’ internet communications and highly detailed personal profile information about peoples’ interests, race, religion, sexual orientation, and health status. (Id. ¶¶ 12, 13.)
Once RTB participants receive the information about the target they compete for ad space to send the target an advertisement at a specific price. (Id. ¶ 7.) Google is paid by the winning bidder. (Id. ) All RTB participants, even those who do not win and those who do not place a bid, are able to collect the target's data. (Id. ) Google also allows RTB "surveillance participants" to receive users’ data. (Id. ) "Surveillance participants" are participants who have no interest in filling an ad space but who participate in RTB for the sole purpose of gaining access to users’ personal information. (Id. )
Because of RTB, Google is able to earn substantial revenue by selling users’ data. (Id. ¶ 9.) In doing so, Google's practices violate California and federal law, as well as Google's explicit contractual and extracontractual promises to Google's account holders. (See e.g., id. ¶¶ 11-12.) Google improperly sells and disseminates account holders’ personal and private information to thousands of companies notwithstanding Google's express promises not to sell users’ personal information. (Id. ¶¶ 1, 3.) RTB is also problematic because Google fails to disclose the practice to account holders and fails to obtain consent from account holders. (Id. ¶ 21.)
Plaintiffs are Google account holders who frequently use various web browsers, including Google Chrome, Safari, and Edge to request, obtain, and watch audio-visual materials and whose personal information was allegedly shared and sold through Google's RTB process. (Id. ¶¶ 9, 37-68.)
A. Content of the Terms of Service
To create a Google account, an individual must agree to Google's Terms of Service ("TOS"). (Id. ¶¶ 71-72.) Relevant here, the TOS contains two provisions. First, it states that California law governs the contract. (Id. , Ex. 4.) Second, since March 31, 2020, the TOS incorporates Google's "How Our Business Works" page which expressly states: "[w]e don't sell your personal information to anyone." Google also states:
Advertisers do not pay us for personal information, such as your name or email, and we never share that information with advertisers, unless you ask us to. We also never use your emails, documents, photos, or sensitive information like race, religion, or sexual orientation, to personalize ads to you. We share reports with our advertisers to help them understand the performance of their ads, but we do so without revealing any of your personal information. At every point in the process of showing you ads, we keep your personal information protected with industry-leading security technologies.
Google also points to a section titled "permission to use your content," and the language that states that a user gives Google a license to use a users’ content "to customize [Google's] services for you, such as providing recommendations and personalized search results, content, and ads (which you can change or turn off in Ads Settings." (Id. , Ex. 4.) However, Google ignores the express language, also under the "permission to use your content" section, that states "this license doesn't affect your privacy rights—it's only about your intellectual property rights." (Id. , Ex. 4 at 5.) Thus, Google's reliance on this language is inappropriate given the nature of plaintiffs’ claims concern their privacy, not intellectual property rights.
B. Content of the Privacy Policy
Like the TOS, the privacy policy made promises to account holders throughout the class period regarding the protection of their personal information. Relevant here, the privacy policy includes the following promises:
• "[w]e do not share your personal information with companies, organizations, or individuals outside of Google except ... [:] with your consent." (Id. , Ex. 15 at 11.)
• "[w]e don't share information that personally identifies you with advertisers, such as your name or email, unless you ask us to." (Id. , Ex. 15 at 5.)
• "[w]e don't show you personalized ads based on sensitive categories, such as race, religion, sexual orientation, or health." (Id. )
The privacy policy also makes several disclosures, including the following:
• "[w]e collect information to provide better services to all our users ... like which ads you'll find most useful." (Id. , Ex. 15 at 1.)
• [d]epending on your settings, we may show you personalized ads based on your interests." (Id. , Ex. 15 at 5.)
• "[t]he information we collect includes unique identifies, browser type and setting, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number. We also collect information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request." (Id. , Ex. 15 at 2.)
• "[w]e may share non-personally identifiable information publicly and with our partners—like publishers, advertisers, developers, or rights holders. For example, we share information publicly to show trends about the general use of our services. We also allow specific partners to collect information from your browse or device for advertising and measurement purposes using their own cookies or similar technologies." (Id. , Ex. 15 at 13.) (emphasis supplied).
• Personal information is defined as "information that you provide to us which personally identifies you, such as your name, email address or billing information, or other data that can be reasonably linked to such information by Google, such as information we associate with your Google Account." (Id. , Ex. 15 at 28.)
• Non-personally identifiable information is defined as information that is recorded about users so that it no longer reflects or references an individually-identifiable user." (Id. , Ex. 15 at 27.)
II. LEGAL STANDARD
A. Standing
Federal courts are courts of limited jurisdiction. Article III of the Constitution "confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’ " TransUnion LLC v. Ramirez , ––– U.S. ––––, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021). "For there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the case – in order words, standing." Id. (citation and quotation marks omitted). To establish standing, a "[p]laintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo v. Robins , 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016).
B. Failure to State a Claim
Under Federal Rule of Civil Procedure 12(b)(6), a complaint may be dismissed for failure to state a claim upon which relief may be granted. Dismissal for failure under Rule 12(b)(6) is proper if there is a "lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory." Conservation Force v. Salazar , 646 F.3d 1240, 1242 (9th Cir. 2011) (quoting Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1988) ). The complaint must plead "enough facts to state a claim [for] relief that is plausible on its face." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). A claim is plausible on its face "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). If the facts alleged do not support a reasonable inference of liability, stronger than a mere possibility, the claim must be dismissed. Id. at 678-79, 129 S.Ct. 1937 ; see also In re Gilead Scis. Sec. Litig. , 536 F.3d 1049, 1055 (9th Cir. 2008) (stating that a court is not required to accept as true "allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences").
III. ANALYSIS
Google moves to dismiss plaintiffs’ CCAC on the grounds that plaintiffs fail to: (a) allege sufficient facts to establish Article III standing; and in the alternative, fail to state a claim for: (b) breach of contract; (c) breach of implied covenant of good faith and fair dealing; (d) invasion of privacy or claim for intrusion upon seclusion; (e) publication of private information; (f) breach of confidence; (g) disclosure under wiretap law; and (h) a CIPA violation. The Court addresses each in turn.
A. Standing
Google moves to dismiss the CCAC for lack of standing. To establish standing, a "[p]laintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo , 578 U.S. at 338, 136 S.Ct. 1540. Here, traceability and redressability are not at issue.
"To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Id. at 339, 136 S.Ct. 1540 (quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). The critical inquiry raised by Google is whether the injuries alleged are particularized. For an injury to be particularized, it "must affect the plaintiff in a personal and individual way." Spokeo , 578 U.S. at 339, 136 S.Ct. 1540.
Google contends that plaintiffs have not alleged sufficient factual allegations about their online activities to show that they were subject to the challenged practices. Thus, according to Google, plaintiffs have not shown that they suffered a particularized injury.
The Court finds that plaintiffs have alleged enough facts to draw a reasonable inference that they have been injured by Google's conduct. Plaintiffs allege that Google "surreptitiously observes, collects, and analyzes real-time information about everyone engaging on [its] platforms" and services, including Google.com, Chrome, Gmail, YouTube, Android, Google Maps, Google Play, Google Docs, Google Calendars, Google Drive, Google Chat, Google Flights, Google Fit, Google Meet, Google Pay, Google Pixel, Chromebooks, and YouTube TV. (CCAC ¶¶ 9-10.) The complaint contains factual allegations describing the nature and extent of Google's data collection and disclosure practices, including through the use of RTB.
As to plaintiffs specifically, plaintiffs allege that they are Google account holders who frequently use various web browsers, including Google Chrome, Safari, and Edge to access websites from which Google sold and shared account holder information without authorization. (Id. ¶¶ 37-68.) Plaintiffs also allege that they frequently "use[ ] chrome to request, obtain, and watch audio-visual materials", including materials from publishers from which plaintiffs allege, on information and belief, that Google sold and shared plaintiffs’ personal information through Google RTB. This data includes information about the websites plaintiffs visited, the content of those sites, photos, videos, and communications. At this stage, the Court must take these allegations as true, and view them in the light most favorable to plaintiffs, even if made on information and belief. Ellis v. J.P. Morgan Chase & Co. , 950 F. Supp. 2d 1062, 1087 (N.D. Cal 2013). Thus, plaintiffs have sufficiently alleged a particularized injury with respect to Google's data practices. Accordingly, Google's motion on this ground is DENIED .
B. Breach of Contract Claim (Count One)
Next, with respect to plaintiffs’ breach of contract claim, Google argues that plaintiffs do not adequately plead breach. Under California law, to state a claim for breach of contract, a plaintiff must plead the existence of: "(1) [a] contract, (2) the plaintiff's performance of the contract or excuse for nonperformance, (3) the defendant's breach, and (4) resulting damage to the plaintiff." Convergent Mobile, Inc. v. JTH Tax, Inc. , No. 19-cv-6484-YGR, 2020 WL 1940855, at *1 (ND. Cal. Apr. 22, 2020) (citation omitted).
Google also contends that dismissal is appropriate because plaintiffs fail to allege: (1) when they signed up for a Google Account, (2) the documents to which they agreed at that time or at any later date, (3) when any breach of their purported agreement with Google occurred. The Court finds these arguments specious for a Rule 12 motion based solely on the need to provide notice pleading under Rule 8, and Google's significant advantage and control of the information at issue.
In pleading breach, the CCAC alleges that plaintiffs entered into two contracts with Google when they created their Google accounts: (1) the TOS and (2) Google's privacy policy. (CCAC ¶¶ 83-84.) Plaintiffs allege that both sets of contracts promises that Google would not sell or share plaintiffs’ personal information, (Id. ¶¶ 78-82, 91-93), but that Google repeatedly violates these contractual obligations by selling plaintiffs’ personal information through RTB (see e.g., id. ¶ 260) (chart comparing Google's promises versus what Google actually does). Thus, plaintiffs have alleged the required elements of their breach of contract claims based on Google's sharing and selling of their personal data after agreeing not to do so.
Google's arguments to the contrary do not persuade. Google argues that "the language [p]laintiffs rely on for Google's purported contractual promise not to ‘sell’ users’ personal information does not appear anywhere but [Google's How Our Business Works" page which, according to Google, is not part of the TOS. This argument fails for two reasons. First, plaintiffs do not only rely on the language of the "How Our Business Works" page, but also rely on language found in Google's privacy policy. (See e.g., id. , Ex. 15 at 5) ("we don't share information that personally identifies you with advertisers"). Second, the Court finds for purposes of this motion that the post March 31, 2020 TOS arguably incorporates Google's "How Our Business Works" page because the page is prominently displayed, is hyperlinked, and makes additional commitments to users, including the promise that Google "never sell[s] your personal information to anyone and you can use many of our products without signing in or saving any personal information at all.") (Id. , Ex. 5 at 1); See Calhoun v. Google LLC , 526 F. Supp. 3d 605, 633 (N.D. Cal. 2021) (finding hyperlinked documents to be incorporated where they provided additional commitments).
Next, Google argues that no actual breach of the privacy policy is alleged because plaintiffs do not allege that Google shared any information, much less "personal information." Not so. As explained above, see supra III.A (standing), plaintiffs have alleged enough facts to draw a reasonable inference that their personal information had been shared by Google by way of the RTB process.
Moreover, plaintiffs allege that Google shares "a Google ID for each account holder"; "the account holder's IP address"; "the account holder's unique device identifier"; and information about account holders’ "interests relating to race, religion, health, and sexual orientation." (See e.g. , CCAC ¶ 14.) This data falls within the definition of personal information under California law, which expressly governs Google's TOS. (See id. , Ex. 4.) California law defines personal information as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household," including "Internet or other electronic network activity information," such as "browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement." Cal. Civ. Code § 1798.140. Not surprisingly, Google's privacy policy is consistent with California law and defines personal information as "information that you provide to us which personally identifies you, such as your name, email address, or billing information, or other data that can reasonably be linked to such information by Google, such as information we associate with your Google account." (CCAC ¶ 87, Ex. 15). Because the Court finds that the information at issue in this case falls within the broad definition of personal information, as defined under both California law and in Google's privacy policy, Google's motion on this ground is denied.
Google also argues that plaintiffs fail to allege that they opted out of receiving personalized ads. However, Google's disclosures about personalized ads and the ability to opt out pertain only to Google's use of users’ information for its own purposes of targeted advertising, not the selling and sharing of users’ information to third parties. Thus, this argument does not persuade.
In sum, plaintiffs have plausibly alleged a claim for breach of contract based on Google's sharing and selling of plaintiffs’ personal information as part of Google's RTB process. The motion to dismiss on this ground is DENIED .
C. Breach of Implied Covenant Claim (Count Two)
Next, Google moves to dismiss the breach of implied covenant of good faith and fair dealing claim because plaintiffs base the claim on obligations and duties not contemplated by the contract and because the claim is largely duplicative of the breach of contract claim. The covenant of good faith and fair dealing, implied by law in every contract, exists merely to prevent one contracting party from unfairly frustrating the other party's right to receive the benefits of the agreement actually made." Durell v. Sharp Healthcare , 183 Cal. App. 4th 1350, 1369, 108 Cal.Rptr.3d 682 (Cal. Ct. App. 2010) (emphasis and citation omitted). The covenant thus cannot be endowed with an existence independent of its contractual underpinnings. It cannot impose substantive duties or limits on the contracting parties beyond those incorporated in the specific terms of their agreement." Durell , 183 Cal. App. 4th at 1369, 108 Cal.Rptr.3d 682 (citations omitted) (emphasis in original). "If there exists a contractual relationship between the parties, ... the implied covenant is limited to assuring compliance with the express terms of the contract, and cannot be extended to create obligations not contemplated in the contract." Racine & Laramie, Ltd. v. Dep't of Parks & Recreation , 11 Cal. App. 4th 1026, 1032, 14 Cal.Rptr.2d 335 (1992).
While the Court has found a sufficiently pleaded contract claim as stated above, the Court finds that the cause of action for breach of implied covenant of good faith and fair dealing is largely duplicative of plaintiffs’ breach of contract claim. The Court notes that a claim for breach of the implied covenant of good faith and fair dealing is not duplicative of a breach of contract claim when a plaintiff alleges that the defendant acted in bad faith to frustrate the benefits of the alleged contract. See Guz v. Bechtel Nat. Inc. , 24 Cal. 4th 317, 353 n.18, 100 Cal.Rptr.2d 352, 8 P.3d 1089 (2000). However, plaintiffs only conclusorily allege bad faith here. (CCAC ¶ 369 ("Google's use of plaintiffs’ and class members’ personal information to target them and enable other companies to add to their own user profiles was in bad faith.")). In opposition to the motion, plaintiffs argue that they sufficiently pled bad faith acts that frustrate the purpose of the contract. (Dkt. No. 104-4, Opposition, "Opp.", at 10.) In arguing such, plaintiffs argue that they "[pled] that Google broke express promises—which were consistent with the terms of the contract—that it would not sell or share [a]ccount [h]olders’ [personal information]. (Id. ) However, such allegation depends on the duties of the contracts (i.e. "express promises") and is thus duplicative.
Further, to the extent plaintiffs’ claims also rely on Google's extracontractual terms or alleged duties that are not part of the parties’ contract, the claims fail because the covenant of good faith and fair dealing "cannot impose substantive duties or limits on the contracting parties beyond those incorporated in the specific terms of their agreement." Durell , 183 Cal. App. 4th at 1369, 108 Cal.Rptr.3d 682. Thus, plaintiffs’ reliance on extracontractual promises and duties not found in the contracts does not save their claims.
Because the pleading fails to adequately allege that the disclosure and sale of plaintiffs’ personal information was prompted by bad faith, or that the claims go beyond the breach of contract claims, the motion to dismiss this cause of action is GRANTED. Plaintiffs’ may later file a motion to seek leave to amend if discovery reveals additional evidence which can be pled to support this claim.
D. Invasion of Privacy and Intrusion Upon Seclusion Claims (Counts Four/Five)
Next, Google moves to dismiss plaintiffs’ invasion of privacy and intrusion upon seclusion claims because plaintiffs have not alleged that Google shared their own information and because plaintiffs have not alleged a reasonable expectation of privacy. Having already found that plaintiffs sufficiently allege that their own personal information was shared and sold as part of the RTB process, the Court only addresses whether plaintiffs have alleged a reasonable expectation of privacy.
To state a claim for invasion of privacy under the California Constitution, a plaintiff must plead: (1) they possess a legally protected privacy interest, (2) they maintain a reasonable expectation of privacy, and (3) the intrusion is highly offensive. Hernandez v. Hillsides, Inc. , 47 Cal 4th 272, 287, 97 Cal.Rptr.3d 274, 211 P.3d 1063 (2009). A claim for intrusion upon seclusion under California common law involves similar elements. Plaintiffs must show that: (1) a defendant "intentionally intrude[d] into a place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy," and (2) that the intrusion was "highly offensive" to a reasonable person. Id. at 286, 97 Cal.Rptr.3d 274, 211 P.3d 1063. Because of the similarity of the tests, courts consider the claims together and ask whether: (1) there exist a reasonable expectation of privacy, and (2) the intrusion was highly offensive. See In re Facebook, Inc., Internet Tracking Litig. ("Facebook Tracking "), 956 F. 3d 589, 605 (9th Cir. 2020). Whether the conduct was highly offensive can rarely be resolved at the pleading stage. Id. at 606.
Thus, the relevant question here is whether plaintiffs would reasonably expect that Google would use its access to account holders’ personal information to share and sell it to third parties. Plaintiffs argue that the amount of data, its sensitivity, the nature of the misuse, and the representations that Google made to account holders that they would never sale their personal information makes it such that plaintiffs had a reasonable expectation of privacy.
Google relies on its TOS and Privacy Policy disclosures to argue that plaintiffs lack a reasonable expectation of privacy in the information because Google provided sufficient notice of this conduct. Specifically, Google points to the following language as sufficient disclosure of the practice challenged in this lawsuit:
• Google uses "automated systems and algorithms to analyze your content" in order to "customize our services for you, such as providing recommendations and personalized search results, content, and ads (which you can change or turn off in Ad Settings." (CCAC, Ex. 4 at 7) (TOS)
• "We may show you personalized ads based on your interests." (Id. , Ex. 15 at 5) (Privacy Policy)
• "We may share non-personally identifiable information publicly and with our partners—like publishers, advertisers, developers, or rights holders." (Id. at 12) (Privacy Policy)
• "We use your personal information to make our products more helpful to you," such as by "show[ing] ads based on your interests." (Id. , Ex. 5 at 1-2) (Google's "How Our Business Works" page).
While plaintiffs might have been informed about Google's use of information for its own internal purposes such as directing targeted advertising to plaintiffs, the referenced disclosures do not disclose the challenged conduct here—the sale and disclosure of plaintiffs’ personal information to third parties without plaintiffs’ consent or knowledge. Plaintiffs allege that Google does not inform account holders that it would sale and disclose its personal information to third parties. Plaintiffs also adequately allege that Google's policies inform account holders that such information would never be sold to third parties without consent.
Plaintiffs have alleged sufficient facts to show that Google's disclosure and sale through the RTB process was not sufficiently disclosed to account holders, and therefore they could not consent to the conduct. The "critical fact [that] [Google] represented to the plaintiffs that their information would not be [sold] but then proceeded to [sale] it anyways" undermines Google's argument that plaintiffs lack a reasonable expectation of privacy. Facebook Tracking , 956 F.3d at 603 (finding plaintiffs adequately alleged a reasonable expectation of privacy where challenged conduct was not disclosed).
The nature and volume of the collected information is also important. Plaintiffs allege that Google sold and shared information relating to plaintiffs’ web browsing histories, device information, and consumer interest data. Specifically, plaintiffs allege that Google sells sensitive personal information such as plaintiff's IP address, geo-location data, and web-browsing information, search terms, and sensitive websites that plaintiffs visited relating to race, religion, sexual orientation, and health. Google argues that such information is routinely shared and thus cannot support a reasonable expectation of privacy. Not so. First, such information is personal information under California law and parties generally maintain a reasonable expectation in their personal information. See Cal. Civ. Code § 1798.140 (explaining that "Internet or other electronic network activity information," such as "browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement").
Second, the Ninth Circuit's decision in Facebook Tracking forecloses Google's argument that plaintiffs do not maintain a reasonable expectation of privacy in their browsing activities. There, the Ninth Circuit held that plaintiffs adequately alleged a reasonable expectation of privacy where the Facebook allegedly collected and created "highly personalized profiles from [plaintiffs’] sensitive browsing histories and habits." Facebook Tracking , 956 F.3d at 603.Taking plaintiffs’ allegations as true, as required at this stage of litigation, the Court finds that plaintiffs’ allegations that Google shared and sold plaintiffs’ personal and sensitive information without disclosing that it would precludes the Court from finding that plaintiffs have no reasonable expectation of privacy in this information. Accordingly, the motion to dismiss on this ground is DENIED .
E. Publication of Private Information (Count Six)
To state a claim for public disclosure of private facts, a plaintiff must show: (1) public disclosure (2) of a private fact (3) which would be offensive and objectionable to the reasonable person and (4) which is not of legitimate concern." Shulman v. Grp. W. Prods., Inc. , 18 Cal. 4th 200, 214, 74 Cal.Rptr.2d 843, 955 P.2d 469 (1998) (citation omitted). The disclosure must be "widely published and not confined to a few persons or limited circumstances." Hill v. Nat'l Collegiate Athletic Ass'n , 7 Cal. 4th 1, 27, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994).
Google argues plaintiffs only allege disclosure to a limited group of RTB participants which would not qualify as "widely published." This argument does not persuade. Plaintiffs allege that Google operates "the world's largest ad exchange" by way of Google's RTB process, and that through Google's RTB process, over 1 million publishers are known to participate in the RTB bidding process. (CCAC ¶¶ 113, 195.) Of those publishers, Google gave publicity to plaintiffs’ and class members’ private facts and the use of their sensitive information by selling it to hundreds of companies. (Id. ¶ 412.) Given the large number of participants in the RTB bidding process, the Court finds that plaintiffs have adequately alleged disclosure.
Google's remaining arguments relating to whether the information is private and whether such disclosure would be offensive to the reasonable person also fail. As explained above, plaintiffs have adequately alleged that the alleged information is private. (See Supra III. D.) Further, Google's alleged surreptitious disclosure and sale of such information to hundreds and thousands of bidders without prior knowledge or consent is sufficient, at this pleading stage, to state a claim. Thus, Google's motion on this ground is also DENIED .
F. Breach of Confidence Claim (Count Seven)
Google contends that plaintiffs’ breach of confidence claim is duplicative of plaintiffs’ breach of contract claim. To prevail on a claim for breach of confidence under California law, a plaintiff must demonstrate that: "(1) the plaintiff conveyed confidential and novel information to the defendant; (2) the defendant had knowledge that the information was being disclosed in confidence; (3) there was an understanding between the defendant and the plaintiff that the confidence be maintained; and (4) there was a disclosure or use in violation of the understanding." Berkla v. Corel Corp. , 302 F.3d 909, 917 (9th Cir. 2002) (citation omitted). To the extent that plaintiffs argue that Google's promises about confidentiality are based on extracontractual promises, plaintiffs’ claims for breach of confidence is not barred by plaintiffs’ breach of contract claims. However, to the extent plaintiffs’ claims rely on Google's promises about confidentiality as found in the TOS and privacy policies, those claims are duplicative of the breach of contract claims and are therefore understood to be pled in the alternative of plaintiffs’ breach of contract claims. (See Opp. at 16 (arguing that plaintiffs can allege these claims in the alternative)); see also SocialApps, LLC v. Zynga, Inc. , No.11-cv-4910-YGR, 2012 WL 381216, at *3 (N.D. Cal. Feb 6, 2012).
Google also argues that plaintiffs’ claims should be dismissed on the merits because plaintiffs have failed to plead any factual allegations that plausibly show that any confidential or novel information was disclosed. Plaintiffs allege throughout their complaint that Google sold and disclosed confidential information such as the content of their internet communications. (CCAC ¶ 419.) The complaint adequately describes the nature of this information, including health data such as whether someone suffers from depression or eating disorders, or information about one's race, sexual orientation, and religious beliefs. (See e.g., id. ¶¶ 143.) Plaintiffs allege that the combination and totality of various different categories of their personal information makes such disclosure novel. (Id. ¶ 419.) Truth cannot be determined at this stage, and viewing these allegations in plaintiffs’ favor, as the Court must at this stage, the Court finds that plaintiffs have adequately alleged that Google disclosed confidential and novel information.
Google's remaining arguments that plaintiffs failed to allege that Google understood that plaintiffs disclosed their information in confidence or that Google and plaintiffs shared an understanding that confidence would be maintained is belied by the express language of Google's policies, including the language found in Google's "How Our Business Works" page, as previously discussed. (See id. , Ex. 5 at 2.)
In sum, Google's motion on this ground is also DENIED .
G. ECPA Wiretap Act Claim for Disclosure (Count Ten)
Next, Google moves to dismiss plaintiffs’ ECPA claims. The ECPA provides that "a person or entity providing an electronic communication service to the public shall not intentionally divulge the contents of any communication [ ] while in transmission on that service to any person or entity other than an addressee or intended recipient of such communication or an agent of such addressee or intended recipient." 18 U.S.C. §§ 2511(3)(a). Google moves to dismiss on two grounds: (1) the alleged conduct does not involve "contents" of communications, and (2) any alleged disclosure occurred with the parties’ consent.
Google moves to dismiss plaintiffs’ violation of the ECPA Wiretap Act-Unauthorized Disclosure of Electronic Communications by an Electronic Communication Service. In its briefing Google refers to the claims as the as the "Wiretap Act" claims, whereas plaintiffs refer to the claims as their "ECPA claims." Consistent with the language used in the complaint and plaintiffs’ briefing, the Court refers to the claims as the ECPA claims.
1. Contents of Communications
With respect to the content of their communications, plaintiffs allege that Google redirects the following content of electronic communications to other companies in the RTB process, including an: "array of [ ] content categories of the site or app"; "array of [content] categories that describe [the] current section of the site or app"; "URL of the page where the impression will be shown"; "referrer URL that caused navigation to the current page"; "details about the publisher object of the site or app"; "details about the content within the site or app"; "[ ] list of keywords about [the] site or app"; and content about the titles and series. (CCAC ¶ 449); see In re Zynga Privacy Litigation , 750 F.3d 1098, 1107 (9th Cir. 2014) (explaining that ECPA applies where a plaintiff's communication is disclosed but not where only record information relating to that communication is disclosed.) Because the ECPA broadly defines "content" as that which "includes any information relating to the substance, purport, or meaning" of the communication at issue, the Court finds that plaintiffs have adequately alleged that the disclosed information, which includes their communications and the substance of those communications, fall within the definition of content under the ECPA. Thus, the motion on this ground is DENIED .
2. Consent
Google next claims there was lawful consent from both the account holder and the websites. Google bears the burden of proof on consent. Matera v. Google, Inc. , No. 15-CV-04062-LHK, 2016 WL 5339806, at *17 (N.D. Cal. Sept. 23, 2016). Consent "can be explicit or implied, but any consent must be actual." In re Google, Inc. , 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013). In order for consent to be actual, the disclosures must "explicitly notify" users of the practice at issue. Id.
With respect to consent, Google repeats its argument that plaintiffs were provided sufficient notice of the challenged conduct and were told that they could opt out of personalized ads but chose not to do so. Again, these arguments fail. Plaintiffs’ decision whether to opt out of personalized ads is not dispositive of Google's alleged sale and disclosure plaintiffs’ information to third parties. (See supra III.D). Focusing on the alleged consent of the publisher is similarly non-dispositive at this juncture given that the policy upon which Google relies on does not concern the sale and disclosure to third parties.
Thus, the Court DENIES defendant's motion on this ground.
H. CIPA Claim (Count Eight)
In moving to dismiss plaintiffs’ CIPA claims, Google argues (1) the conduct alleged does not involve "contents" of communications and (2) the non-California plaintiffs do not allege that the alleged interceptions were sent or received within California.
Because the meaning of "contents" of a communication under CIPA is the same under the ECPA, see Brodsky v. Apple Inc. , 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020), Google's first argument fails for the reasons stated above. (See supra III.G.1).
Next, regarding whether the communications occurred while they were in California or while the communications were "being sent from, or received at any place within [the] state." Cal. Penal Code § 631(a). The Court infers that it is plausible that at least one of the hundreds of RTB recipients and publishers received the communications at issue while they were located in California. To the extent there is uncontroverted proof to the contrary, Google shall produce it to the plaintiffs immediately and the parties shall meet and confer regarding the dismissal of the claim for the non-California plaintiffs.
Accordingly, the motion on this ground is DENIED .
IV. CONCLUSION
For the foregoing reasons, the motion to dismiss is GRANTED AS TO COUNT 2 AND DENIED AS TO ALL OTHER COUNTS .
Plaintiffs’ Administrative Motion to File Under Seal Plaintiffs’ Administrative Motion to Consider Whether Another Party's Materials Should be Sealed (Dkt. No. 113) and Google's response and motion at Dkt. No. 119 is hereby Granted because the information contains Google's confidential business information. The Court seals the requested information for the limited purpose of the pending motion to dismiss only, given the procedural posture of the case. This Order does not mean that future requests to seal this information will be automatically given.
Google shall file its answer as to Counts 1, 4, 5, 6, 7, 8, and 10 within twenty-one (21) days from the date of this order.
The Court SETS a case management conference for MONDAY , AUGUST 22, 2022 AT 2:00 PM .
This Order terminates Docket Number 93, 113 and 119.