finding that the plaintiffs had standing to pursue a CDAFA claim where they alleged that the defendant's conduct drained the batteries of their mobile devicesSummary of this case from In re Facebook Internet Tracking Litig.
No. 11-MD-02264 JSW
NOT FOR PUBLICATION
ORDER ON MOTION TO
DISMISS AND MOTION TO
(Docket Nos. 29 and 35)
Now before the Court for consideration are the motion to dismiss filed by Defendants Google, Inc. ("Google"), AdMob, Inc. ("AdMob"), and AdWhirl, Inc. ("AdWhirl") (collectively the "Google Defendants"), and the motion to strike filed by Plaintiffs. The Court has considered the parties' papers, relevant legal authority, and the record in these cases, and it HEREBY GRANTS, IN PART, AND DENIES, IN PART, the Google Defendants' motion, DENIES AS MOOT Plaintiffs' motion to strike, and GRANTS Plaintiffs leave to amend.
The named Plaintiffs are Juliann King, Julie Brown, Theodore Spradley, Kenrick Cochran, Nicholas Lawrence, Sid Lajzer, Brian Hicks, Beverly Levine, Joan Smith, Maritsa Urias, James and Jessica Jefferys, Phillip Hall, and M.G., who is thirteen. (Id.) Brown, Spradley, Lawrence, Lajzer, Hicks, Levine, Smith, Urias, the Jefferys, Hall, and M.G. are not residents of California.
Plaintiffs have not complied with Northern District Local Rule 3-4(c)(2), which requires that footnotes be in 12 point font. The Court HEREBY places all parties on notice that if any party fails to comply with this rule in the future, the Court shall strike the offending brief without further notice to that party.
The facts set forth herein are accepted as true solely for purposes of evaluating the motions to dismiss.
Google designed the Android operating system for mobile devices. The Android operating system is an "open" system, which means that it can be used and adapted by manufacturers of mobile phones and developers of mobile device applications ("App" or "Apps"). (Docket No. 24, First Amended Consolidated Class Action Complaint ("FACC"), ¶ 44.) Plaintiffs each owned and used an Android mobile device and used Apps they either downloaded from the Android Market (including Dictionary.com Ad-Free, Foursquare, Groupon, MovieFone, UrbanSpoon, Advanced Task Killer, Pandora, Angry Birds, and Buddist Dhammapada) or which were integrated into the Android operating system (including the Flashlight App). (Id. ¶¶ 25-37.)
Google also provides advertising services to App developers, and it acquired AdMob in 2009. (Id. ¶ 39.) AdMob "purports to be 'the world's largest mobile advertising marketplace' offering 'both advertisers and publishers the ability to target and personalize advertising to their customers...." (Id. ¶ 41.) AdWhirl is a subsidiary of AdMob, and operates a platform that allows advertisers to dynamically switch campaigns from one ad network to another. (Id. ¶ 42.)
On October 22, 2008, Google launched the Android Market, an online software store designed by Google, where users of a device running the Android operating system can search for and download Apps, either for free or for purchase. (Id. ¶ 45.) Through the Android Market and the Android operating system, Google created a technical environment by which it, AdMob and AdWhirl have access substantial information about the Plaintiffs.
Google designed the Android operating system to include software "hooks." These software hooks make information about a particular Android mobile device available to an App that is running on the device. The software hooks also enable an App to determine what a user is doing with the mobile device. Google provides App developers with a software development kit ("SDK") that includes code necessary to take advantage of these software hooks. (Id.)
"Defendants provided App Developers with specific [application programming interface ("API")] code to be embedded in Plaintiffs' Apps in order to accomplish the data collection sought by Defendants. Depending on the Defendant, the purposes accomplished by the code Defendants embedded in the Apps included collection of Plaintiffs' information to identify and track Plaintiffs' activity and location data for use in building behavioral profiles of Plaintiffs for purposes of ad-targeting, and to compile analytics data regarding Plaintiffs' use of Apps." (Id. ¶ 50.)
Plaintiffs discovered that the Google Defendants used code hidden in Apps, which Plaintiffs classify as "spyware," to collect personally identifiable information ("PII"), including Plaintiffs' name, gender, zip code, App activity (including search terms or selections), geolocation data, and their phones' universally unique device identifiers ("UUID"). (Id. ¶¶ 57-59, 63-77.) Plaintiffs contend that the Google Defendants collected this data without providing proper notice and without their knowledge and consent. (Id. ¶¶ 58, 86.) Google also misrepresented that users PII would be anonymized, when in fact the geolocation data is linked back to a user's UUID. (Id. ¶ 88.)
The data that the Google Defendants collect is personal property, which has an "independent, quantifiable market value," because the information is often sold for marketing and research purposes. However, because the Google Defendants disseminated that information without Plaintiffs' consent, the value of that information has been diminished, and Plaintiffs "lost the opportunity to profit from such information at full market value." (Id. ¶¶ 89-94.) In addition, the batteries on Plaintiffs' Android mobile devices discharge more quickly, because the process of collecting geolocation data is resource intensive and consumes battery life. (Id. ¶¶ 96-98.)
Based on these and other allegations, which the Court shall address as necessary, the Plaintiffs bring claims for: (1) violations of the Computer Fraud and Abuse Act, 18 U.S.C. section 1030 (the "CFFA Claim"); (2) violations of California's Unfair Competition Law, California Business and Professions Code sections 17200, et seq. (the "UCL Claim"); (3) violations of their right to privacy under Article I, Section I of the California Constitution (the "Right to Privacy Claim"); (4) violations of California's Comprehensive Computer Data Access and Fraud Act, California Penal Code section 502 (the "CDAFA Claim"); (5) Negligence; and (6) Trespass to Chattels.
Plaintiffs withdrew their claim for violations of California's Invasion of Privacy Act, California Penal Code section 630, and do not oppose the Google Defendants' motion to dismiss that claim. (Docket No. 34, Opp. Br. at 2 n.1.) The Court GRANTS the Google Defendants' motion to dismiss that claim.
A. Applicable Legal Standards.
The Google Defendants move to dismiss on the basis that the Plaintiffs lack standing under Article III of the United States Constitution. The Court evaluates the motion to dismiss for lack of standing pursuant to Federal Rule of Civil Procedure 12(b)(1). See White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). A motion to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1) may be "facial or factual." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). In this case, the Google Defendants raise a facial challenge to Plaintiffs' standing and, therefore, the Court "must accept as true all material allegations in the complaint, and must construe the complaint in" Plaintiffs' favor. Chandler v. State Farm Mut. Auto Ins. Co., 598 F.3d 1115, 1121-22 (9th Cir. 2010); see also Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) ("At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion dismiss, [courts] presume that general allegations embrace those specific facts that are necessary to support the claim.") (internal cite and quotations omitted).
The Google Defendants also move to dismiss each of the claims pursuant to Rule 12(b)(6). A motion to dismiss is proper under Rule 12(b)(6) where the pleadings fail to state a claim upon which relief can be granted. The Court construes the allegations in the complaint in the light most favorable to the non-moving party and all material allegations in the complaint are taken to be true. Sanders v. Kennedy, 794 F.2d 478, 481 (9th Cir. 1986). However, even under the liberal pleading standard of Rule 8(a)(2), "a plaintiff's obligation to provide the 'grounds' of his 'entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)).
Pursuant to Twombly, a plaintiff must not merely allege conduct that is conceivable but must instead allege "enough facts to state a claim to relief that is plausible on its face." Id. at 570. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S.662, 678 (2009) (citing Twombly, 550 U.S. at 556). "The plausibility standard is not akin to a probability requirement, but it asks for more than a sheer possibility that a defendant has acted unlawfully.... When a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief." Id. (quoting Twombly, 550 U.S. at 557) (internal quotation marks omitted).
If the allegations are insufficient to state a claim, a court should grant leave to amend, unless amendment would be futile. See, e.g., Reddy v. Litton Indus., Inc., 912 F.2d 291, 296 (9th Cir. 1990); Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv., Inc., 911 F.2d 242, 246-47 (9th Cir. 1990).
B. The Court Denies as Moot the Motion to Strike.
Plaintiffs move to strike exhibits attached to a declaration submitted by Michael Rubin, as well as all references to those exhibits in the Google Defendants' motion. Because the Court did not rely on any of those exhibits to resolve the motion to dismiss, it denies the motion to strike as moot. In the event this issue arises in subsequent motion practice, the Court advises the parties that the briefing on this issue was excessive in light of the issue presented. Furthermore, under Northern District Local Rules 7-3(a) and 7-3(d), objections to evidentiary materials must be contained within a party's brief, rather than in a separate brief. If either party fails to comply Local Rule 7-3 in the future, the Court will deny a separate motion to strike as procedurally improper.
C. Article III Standing.
The Google Defendants move to dismiss on the basis that none of the Plaintiffs have standing under Article III of the United States Constitution. In order to satisfy the Constitution's standing requirements, a plaintiff must show: (1) he or she has suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) that the injury is fairly traceable to the challenged action of the defendant; and (3) that it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Lujan, 504 U.S. at 560-61; see also Clapper v. Amnesty International, - S.Ct. -, 2013 WL 673353, at *7 ("[W]e have repeatedly reiterated that threatened injury must be certainly impending to constitute injury in fact, and that allegations of possible future injury are not sufficient.") (internal quotations, citations and brackets omitted, emphasis in original). A plaintiff also may establish the requisite injury "by virtue of 'statutes creating legal rights, the invasion of which creates standing.'" Edwards v. First Am. Financial Corp., 610 F.3d 514, 517 (9th Cir. 2010) (quoting Fulfillment Servs., Inc. v. United Parcel Serv., Inc., 528 F.3d 614, 618-19 (9th Cir. 2008)).
"The jurisdictional question of standing precedes, and does not require, analysis of the merits." Equity Lifestyle Props., Inc. v. County of San Luis Obispo, 548 F.3d 1184, 1189 n.10 (9th Cir. 2008). Thus, "[a] plaintiff may satisfy the injury-in-fact requirements to have standing under Article III, and ... may be able to 'bring a civil action without suffering dismissal for want to standing to sue,' without being able to assert a cause of action successfully." In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 712 n.5 (N.D. Cal. 2011) (quoting Doe v. Chao, 540 U.S. 614, 624-25 (2004)).
Plaintiffs argue that they have alleged facts sufficient to show standing because they allege: (1) the Google Defendants diminished the value of their PII; (2) the Google Defendants diminished the value of their mobile devices, because of the increased rate at which the batteries discharge; (3) they overpaid for their Android mobile devices; (4) they incurred costs because the Google Defendants utilized valuable computer resources; and (5) they allege violations of constitutional and statutory rights The Court addresses each of these arguments in turn.
1. Dimunition in Value of PII.
Although the Ninth Circuit has yet to address the issue, district courts have been reluctant to find standing based solely on a theory that the value of a plaintiff's PII has been diminished. See, e.g., In re Google, Inc. Privacy Litig., 2012 WL 6378343, at *4-6 (N.D. Cal. Dec. 28, 2012); In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1054 (2012) ("Plaintiffs have alleged additional theories of harm beyond their theoretical allegations that personal information has independent economic value."); Low v. Linkedin Corp., 2011 WL 5509848, at *4-5 (N.D. Cal. Nov. 11, 2011) ("Low I"); In re iPhone Application Litig., 2011 WL 4403963, at *4 (N.D. Cal. Sept. 20, 2011) ("iPhone I"); LaCourt v. Specific Media, Inc., 2011 WL 2473399, at * 4 (C.D. Cal. Apr. 28, 2011). Plaintiffs do not allege sufficient facts to show what harm, if any, resulted from the access to and tracking of their PII. For example, Plaintiffs do not identify which Android mobile devices they used and which of the Apps accessed and tracked their information. See, e.g., Pirozzi v. Apple, Inc., - F. Supp. 2d -, 2012 WL 6652453, at *4 (N.D. Cal. Dec. 20, 2012); iPhone I, 2011 WL 4403963, at *4.
Similarly, although Plaintiffs allege that a market exists that could provide them the opportunity to sell their PII, none of the Plaintiffs specifically tie those allegations to them. Plaintiffs also do not allege they attempted to sell their personal information, that they would do so in the future, or that they were foreclosed from entering into a value for value transaction relating to their PII, as a result of the Google Defendants' conduct. See, e.g., Low I, 2011 WL 5509848, at *5 (finding that plaintiff lacked standing where he failed to allege facts showing how he was foreclosed from capitalizing on the value of his personal data or how he was 'deprived of the economic value of [his] personal information simply because [his] unspecified personal information was purportedly collected by a third party'") (quoting LaCourt, 2011 WL 1661532 at *5); LaCourt, 2011 WL 1661532, at *4-5 (court noted that it "probably would decline to say that it was categorically impossible for [p]laintiffs to allege some property interest" relating to value of personal information, but found plaintiffs lacked standing because they failed "identify a single individual who was foreclosed from entering into a 'value-for-value exchange'" as a result of defendant's practices). Even if the Court assumes that PII is a form of personal property, the court concludes the Plaintiffs have not alleged facts sufficient to show injury based on the purported dimunition in value of their PII.
2. Diminished Battery Capacity.
Plaintiffs also allege they have been injured because the batteries in their mobile devices discharge more quickly. Courts have found that "[d]imunition in the performance of an electronic device may constitute an injury in fact, but a plaintiff must 'allege facts showing that this is true.'" Goodman v. HTC America, Inc., 2012 WL 2412070, at *6 (W.D. Wash. June 26, 2012) (quoting LaCourt, 2011 WL 1661532, at *5) (emphasis added). For example, in iPhone II, the court concluded that allegations regarding diminished storage, battery life, and bandwidth were sufficient to allege actual injury, where the plaintiffs alleged they paid for the exclusive use of the memory and included information about the large amount of memory the defendants had consumed. See 844 F. Supp. 2d at 1054-56.
Similarly, in Goodman, the plaintiff alleged that the defendants collected fine location data every three hours, or whenever a device's screen was refreshed, which caused the batteries to drain more quickly. The plaintiffs also alleged that the defendants reduced "utility and lifespan of the phone batteries ... because each charge and discharge cycle causes chemical changes in the active battery material, diminishing the battery's storage capacity and requiring every more frequent recharging." Goodman, 2012 WL 2412070, at *7. The court found those allegations were specific enough to allege injury. Id. In contrast, a court within this District recently concluded that allegations regarding a defendant's use of "two to three seconds of battery capacity" was de minimus and, implicitly, insufficient to establish standing. See Hernandez v. Path, Inc., 2012 WL 5194120, at *2 & n.2 (N.D. Cal. Oct. 19, 2012).
Plaintiffs' allegations regarding the chemical changes to the battery material are nearly identical to the allegations in Goodman. Although Plaintiffs do not allege how frequently Google collects geolocation data, they do allege that their batteries discharged more quickly and that their services were interrupted. (See FACC ¶ 98.) Although it is close question, the Court finds the facts in this case are more analogous to the facts in Goodman than in Path. Therefore, the Court concludes that these allegations are sufficient, at the pleading stage, to allege standing, but only as to Google. Plaintiffs do not allege facts that showing this alleged injury is fairly traceable to conduct taken by AdMob or AdWhirl.
In their trespass to chattels claim, Plaintiffs make generalized allegations that the Defendants consumed other resources on their phones. However, the Court finds that these allegations are too conclusory and are not supported by facts that would be sufficient to allege standing as to AdMob and AdWhirl. (See generally FACC ¶ 187.)
Plaintiffs allege that they "lost money, including the difference between what they paid for their mobile devices and the devaluation of their mobile devices as a result of Defendants' privacy invading and resource-consuming functions." (FACC ¶ 137.) "Overpaying for goods or purchasing goods a person otherwise would not have purchased based upon alleged misrepresentations by the manufacturer would satisfy the injury-in-fact and causation requirements for Article III standing." Pirozzi, - F. Supp. 2d -, 2012 WL 6652453, at *4; see also Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 329 (2011); iPhone II, 844 F. Supp. 2d at 1056.
In the iPhone II case, the court concluded that the plaintiffs established they had standing to sue based on allegations that, when they purchased their Apple mobile devices, they relied upon representations regarding privacy protection, which caused them to pay more than they would have for their devices. The court also found the requisite injury, because the Plaintiffs alleged that, as a result of the consumption of storage space, their devices did not perform as promised, which diminished the value of their devices. 844 F. Supp. 2d at 1055-56; see also Goodman, 2012 WL 2412070, at *5 (finding plaintiffs sufficiently alleged injury based on an overpayment theory, where they alleged they would not have purchased HTC smartphones had they known how they worked). In contrast, in the Pirozzi case, the plaintiff failed to "specifically which statements she found material to her decision to purchase an Apple Device or App." Pirozzi, 2012 WL 6552453, at *4. The court concluded that the plaintiff failed to allege facts demonstrating that "she suffered an injury-in-fact that is caused by the complained of conduct." Id.
Unlike the plaintiffs in iPhone II or in Goodman, Plaintiffs do not allege which Android devices they purchased or how much those devices cost. They also do not allege that had they known of the Google Defendants' practices, they either would not have purchased an Android device or would not have paid what they did for such devices. Similarly, like the plaintiff in the Pirozzi case, Plaintiffs do not identify what statements were material to their decision to purchase an Android device or to download or use any given App. The Court finds that Plaintiffs have not alleged sufficient facts to show an injury based on the theory that they overpaid for these devices.
4. Costs Incurred.
Plaintiffs also allege that they incurred costs as a result of the Google Defendants' conduct. (See FACC ¶ 142.) Plaintiffs do not allege facts that identify the nature of those costs. Indeed, this allegation is no more than a bare legal conclusion couched as fact, which the Court is not required to accept as true. These allegations are not sufficient to show injury-in-fact.
5. Invasion of Statutory and Constitutional Rights.
Plaintiffs also rely on a theory of injury based on alleged violations of statutory and constitutional rights. "[T]he actual or threatened injury required by [Article III] may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing...." Warth v. Seldin, 422 U.S. 490, 500 (1975). With respect to the alleged violations of the constitutional right to privacy, the Google Defendants do not dispute that the constitutional provision "can be understood as granting persons in [Plaintiffs' positions] a right to judicial relief." Id. Thus, the Court concludes that Plaintiffs have standing to pursue that claim.
With to their UCL Claim, Plaintiffs must show they suffered an injury in fact and have lost money or property as a result of the alleged unfair competition. See Kwikset, 51 Cal. 4th at 323; see also Cal. Bus. & Prof. Code § 17204. Similarly, the CFAA and CDAFA Claims require some showing of damage or loss, beyond the mere invasion of statutory rights. That fact distinguishes this case from cases where a plaintiff alleges a violation of a statute that does not require a separate showing of injury. See, e.g., In re Facebook Privacy Litig., 791 F. Supp. 2d at 712 (finding plaintiffs had alleged standing where they included claims for violations of Wiretap Act); iPhone II, 844 F. Supp. 2d at 1055; iPhone I, 2011 WL 4403963, at *6 (distinguishing In re Facebook on the basis that the plaintiffs "do not allege a violation of an analogous statute which does not require a showing of injury" and dismissing claims under CFFA and CDAFA for lack of standing).
Accordingly, for these reasons the Court GRANTS, IN PART, AND DENIES, IN PART, the Google Defendants' motion to dismiss for lack of standing. Because the Court concludes that Plaintiffs may be able to cure the deficiencies identified above, the Court GRANTS Plaintiffs leave to amend.
D. The Court Dismisses the CFAA Claim, With Leave to Amend.
In their first claim for relief, Plaintiffs assert that the Google Defendants violated the CFAA. "The CFAA prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1131 (9th Cir. 2009); see also 18 U.S.C. § 1030(a)(1)-(7). The Google Defendants move to dismiss the CFAA claim on the basis that, inter alia, the allegations are insufficient to show the requisite damage or loss. The Court agrees and, for that reason, it does not reach the Google Defendants' alternative arguments.
Plaintiffs premise their claims on alleged violations of Section 1030(a)(5)(A)-(C). Plaintiffs also implicitly reference Section 1030(a)(2)(C). (See FACC ¶¶ 111-119.) In order to bring a civil action under the CFAA, Plaintiffs must be able to show a "loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value." 18 U.S.C. § 1030(g). Plaintiffs also must show damage or loss to establish a violation of Section 1030(a)(5). 18 U.S.C. § 1030(a)(5)(A)-(C). The CFAA defines "damage" as "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). The CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11).
Plaintiffs rely on the same factual allegations that purport to show standing to support the "damage" and "loss" elements of the CFAA Claims. For the reasons discussed above, the Court finds that the majority of these allegations are not sufficient to allege damage and loss. By way of example only, Plaintiffs set forth only a bare legal conclusion, couched as fact, that they incurred costs. (FACC ¶ 142.) With respect to the allegations relating to battery life, there are insufficient facts in the FACC from which the Court could reasonably infer those allegations of damage - even if aggregated - would reach the $5,000 threshold required by the CFAA. See, e.g., iPhone II, 844 F. Supp. 2d at 1067; AtPac, Inc. v. Aptitude Solutions, Inc., 730 F. Supp. 2d 1174, 1184-85 (E.D. Cal. 2010) (citing cases); cf. Del Vecchio v. Amazon.com, 2012 WL 1997697, at *3-*6 (W.D. Wash. June 1, 2012) (dismissing CFAA claim where plaintiffs did not allege facts showing devaluation of their personal information or that they discerned any difference in performance of computer when visiting defendant's website).
Accordingly, the Court GRANTS the Google Defendants' motion to dismiss the CFAA Claim. Because the Court cannot say it would be an act of futility, it grants Plaintiffs leave to amend this claim.
E. The Court Dismisses the UCL Claim, With Leave to Amend.
In their second claim for relief, Plaintiffs assert that the Google Defendants violated the UCL. Under the UCL, "there are three varieties of unfair competition: practices which are unlawful, unfair or fraudulent." Daugherty v. American Honda Motor Co., 144 Cal. App. 4th 824, 837 (2006); see also Albillo v. Intermodal Container Services, Inc., 114 Cal. App. 4th 190, 206 (2003) (to state a UCL claim, a "plaintiff must establish that the practice is either unlawful (i.e., is forbidden by law), unfair (i.e., harm to victim outweighs any benefit) or fraudulent (i.e., is likely to deceive members of the public)"). In addition, the UCL "requires that a plaintiff have 'lost money or property' to have standing to sue. The plain import of this is that a plaintiff now must demonstrate some form of economic injury." Kwikset, 51 Cal. 4th at 323; see also Cal. Bus. & Prof. Code § 17204.
1. Standing Under the UCL.
In Kwikset, the California Supreme Court noted that there are many ways a plaintiff may establish economic injury to show standing under the UCL, including "surrender[ing] in a transaction more, or acquir[ing] in a transaction less, than he or she otherwise would have." Id. Plaintiffs allege that their PII constitutes "personal property," which has been diminished in value. For the same reasons the Court finds that Plaintiffs fail to allege facts to show injury-in-fact for purposes of Article III standing based on these allegations, the Court finds Plaintiffs have not alleged facts that are sufficient to show they lost money or property as a result of the Google Defendants' conduct. See Claridge, 785 F. Supp. 2d at 863 (concluding plaintiff failed to allege statutory standing based on theory that PII constituted currency, where plaintiff failed to show his PII did not cease to belong to him or pass beyond his control).
Plaintiffs also allege that they overpaid for their Android mobile devices and allege that the batteries in their phone discharged more quickly. For the reasons discussed above, the Court finds that Plaintiffs have not alleged facts sufficient to show they lost money or property based on the theory that they overpaid for their Android mobile devices, and finds that with respect to battery life, they have only established standing as to Google.
2. Plaintiffs Fail to State a Claim Under the Unlawful Prong.
Plaintiffs' UCL claim is premised, in part, on allegations that the Google Defendants violated the unlawful prong of the UCL. (FACC ¶¶ 133-134). To state a claim based on the unlawful prong, Plaintiffs must allege that the Google Defendants' practices are "forbidden by law, be it civil, criminal, federal, state, or municipal, statutory, regulatory, or court made." Saunders v. Superior Court, 27 Cal. App. 4th 832, 838-39 (1994). Because the Court finds the Plaintiffs fail to allege facts showing a violation of the CFAA, the CDAFA, the constitutional right to privacy, or any of their other state law claims, Plaintiffs have not stated a claim under the "unlawful prong" of the UCL. See Berryman v. Merit Property Mgmt., Inc., 152 Cal. App 4th 1544, 1554 (2007) ("a violation of another law is a predicate for stating a cause of action" under unlawful prong).
3. Plaintiffs May State a Claim Under the Unfair Prong.
The Google Defendants also argue that Plaintiffs fail to state a claim under the unfair prong. Unfair simply means any practice whose harm to the victim outweighs any benefits. Olsen v. Breeze, Inc., 48 Cal. App. 4th 608, 618 (1996). "The court must weigh the utility of the defendant's conduct against the gravity of the harm to the alleged victim." Gafcon, Inc. v. Ponsor & Assocs., 98 Cal. App. 4th 1388, 1425 n.15 (2002). In iPhone II, the court refused to conclude, as a matter of law, that allegations regarding collection and dissemination of personal information, which are similar to Plaintiffs' allegations, were insufficient to state a claim under the unfair prong. iPhone II, 844 F. Supp. 2d at 1073. The Court finds that reasoning persuasive and concludes that, if Plaintiffs are able to sufficiently allege standing, they would be able to state a claim under the unfair prong.
4. Plaintiffs Fail to State a Claim Under the Fraudulent Prong.
Plaintiffs also assert that the Google's conduct violates the fraudulent prong of the UCL. (See FACC ¶¶ 138-143.) To state a cause of action under the fraudulent prong of Section 17200, it is necessary only to show members of the public are likely to be deceived; allegations that the fraudulent deception was "actually false, known to be false by the perpetrator and reasonably relied upon by a victim who incurs damages" are not necessary. In re Tobacco II Cases, 46 Cal. 4th 298, 312 (2009).
The Google Defendants move to dismiss this aspect of the UCL claim on the basis that Plaintiffs have not satisfied the requirements of Federal Rule of Civil Procedure 9(b) and fail to allege that they relied on the alleged misrepresentations. See In re Tobacco II, 46 Cal. 4th at 328; In re Facebook PPC Advertising Litig., 709 F. Supp. 2d 762, 771 (N.D. Cal. 2010). Although Plaintiffs argue that they would not have purchased their devices had they known the true facts, they do not include those allegations in the FACC. Thus, the Plaintiffs have not alleged sufficient facts to show that they relied on the alleged misrepresentations.
Although Plaintiffs allege that all of the relevant decisions and conduct occurred in California, not all of the Plaintiffs are residents of California. (FACC ¶¶ 25-37, 132.) Thus, it is not clear that the UCL is applicable to the non-resident Plaintiffs' claims for alleged fraudulent conduct. See, e.g., Mazza v. American Honda Motor Co., 666 F.3d 581, 594 (9th Cir. 2012) ("each class member's consumer protection claim should be governed by the consumer protection laws of the jurisdiction in which the transaction took place") (emphasis added).
F. The Court Dismisses the Right to Privacy Claim, With Leave to Amend.
In their third claim for relief, Plaintiffs allege that the Google Defendants violated their constitutional right to privacy. In order to state a claim based on alleged violations of their constitutional right to privacy, Plaintiffs must allege facts showing: (1) a specific, legally protected privacy interest; (2) a reasonable expectation of privacy; and (3) conduct that is "sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right." Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal. 4th 1, 35-37 (1994); see also iPhone II, 844 F. Supp. 2d at 1063. This case raises the issue of "informational privacy," i.e. the alleged "dissemination or misuse of sensitive and confidential information...." Id. at 35.
In iPhone II, the plaintiffs alleged that the defendants collected and disclosed their PII and geolocation data to third parties. The court found that these allegations were not sufficient to satisfy the third element of a right to privacy claim. iPhone II, 844 F. Supp. 2d at 1063. The iPhone II court relied, in part, on Fogelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986 (2011). In the Fogelstrom case, the plaintiff alleged that the defendant "routinely ask[ed] its customers for their ZIP codes during credit card transactions so that it could obtain their home addresses for the purpose of mailing marketing materials to them," and misrepresented why it asked for this information. Fogelstrom, 195 Cal. App. 4th at 989. The Fogelstrom court found that "obtaining plaintiff's address without his knowledge or permission, and using it to mail him coupons and other advertisements ... is not an egregious breach of social norms, but routine commercial behavior." Id. at 992.
In Goodman, supra, the plaintiffs alleged HTC America and three weather applications installed code on certain HTC phones, which "transform[ed] the phones into surreptitious tracking devices," by transmitting fine location data that enabled the defendants to "track their movements, including where they live, work, dine and shop." 2012 WL 2412070, at *1. According to plaintiffs, the defendants then used this information "to build profiles about them, and sell this information to third parties." Id.; see also id., 2012 WL 2412070, at *14 (noting that plaintiffs alleged that defendants "obtained sensitive personal information ... including, inter alia, a continually updated log of precisely where they live, work, park, dine, pick up children from school, worship, vote, and assemble, and what time they are ordinarily at these locations"). The Goodman court concluded that these allegations, in conjunction with allegations that the plaintiffs had alleged they did not expect the defendants to compile profiles about them or share those profiles with third parties, were sufficient to state a claim for violations of California's constitutional right to privacy. Id., 2012 WL 2412070, at *14-15.
Plaintiffs allege that "Google's conduct, ... by design, allowed third party Affiliates, like Defendants AdMob and AdWhirl, to obtain Plaintiffs and Class Members [PII] and to transmit such information without encryption...." (FAC ¶ 146.) Plaintiffs also allege that the Google Defendants tracked and shared "highly detailed and confidential [PII] over a substantial period of time without [the Google Plaintiffs'] knowledge or consent." (FACC ¶¶ 145-146.) The Court finds that these allegations are more analogous to the plaintiffs' allegations in the iPhone II case than the plaintiffs' allegations in the Goodman case and, thus, are not sufficient to allege that the Google Defendants' conduct constitutes an egregious breach of social norms.
Accordingly, the Court GRANTS the Google Defendants' motion to dismiss the Right to Privacy Claim. Although it is skeptical that Plaintiffs will be able to amend this claim, the Court cannot say it would be an act of futility, and it GRANTS Plaintiffs leave to amend this claim.
G. The Court Dismisses the CDAFA Claim, With Leave to Amend.
In their fourth claim for relief, Plaintiffs assert that the Google Defendants violated California Penal Code §§ 502(c)(1)-(8). The Google Defendants move to dismiss this claim on the basis that Plaintiffs have not alleged damage or that the Google Defendants acted "without permission."
1. Plaintiffs do not allege all Defendants caused damage or loss.
In order to state a claim under the CDAFA, Plaintiffs must allege they suffered damage or loss by reason of a violation of Section 502(c). Unlike the CFAA, the CDAFA does not include a monetary threshold for damages, and some courts have concluded that "any amount of loss or damage may be sufficient," to establish statutory standing. See Mintz v. Mark Bartelstein and Associates, Inc., - F. Supp. 2d -, 2012 WL 5391779, at *9 (C.D. Cal. Nov. 1, 2012); Facebook, Inc. v. Power Ventures, Inc., 2010 WL 3291750, at *4 (N.D. Cal. July 20, 2010) ("Power Ventures I"). Although Plaintiffs allege that the Google "Defendants' actions cause Plaintiffs' Android mobile phone batteries to discharge more quickly," and have interrupted their services, those allegations are based on acquisition of location data through GPS satellite position data. As noted above, at best, this might show that Google's actions caused the Google Plaintiffs to suffer some loss or damage. They do not, however, allege that they suffered loss or damage because of actions taken by AdMob or AdWhirl. In addition, for the reasons discussed above with respect to standing, the Court finds that the allegations regarding the diminished value of Plaintiffs' PII are not sufficient to allege damage or loss under the CDAFA.
2. Plaintiffs do not allege the Google Defendants acted "without permission."
Plaintiffs allege that the Google Defendants violated Sections 502(c)(1)-(8) of the CDAFA. Each of these subclauses of the CDAFA explicitly, or by incorporation, requires a showing that the Google Defendants acted "without permission." See Cal. Pen. Code § 502(c)(1)-(8), 502(b)(10) (defining computer contaminant). Courts within this District have interpreted "without permission" to require that a defendant access a network "in a manner that circumvents technical or code based barriers in place to restrict or bar a user's access." Facebook, Inc. v. Power Ventures, Inc., 844 F. Supp. 2d 1025, 1036 (N.D. Cal. 2012) ("Power Ventures II"); see also Power Ventures I, 2010 WL 3291750, at *11.
In iPhone I, the plaintiffs alleged that the defendants "include[d] surreptitious tracking codes in the program code for apps." iPhone I, 2011 WL 4403963, at *12. The court found that these allegations were insufficient to state a claim under the CDAFA. The court noted that the plaintiffs could not show the defendants acted without permission simply by alleging they violated a term of use. Id., 2011 WL 4403963, at *12; see also Brekka, 581 F.3d at 1130; Power Ventures I, 2010 WL 3291750, at * 11. The court also concluded that the plaintiffs failed to allege how the defendants acted "without permission" when "the iOS and third party apps - which contain the alleged 'surreptitious code' were all installed or updated voluntarily by" the plaintiffs. Id. The Court finds this reasoning persuasive.
The Court also concludes that Power Ventures II does not assist Plaintiffs. In that case, the court elaborated further on the meaning of "without permission" and found "no reason to distinguish between methods of circumvention built into a software system to render barriers ineffective and those which respond to barriers after they have been imposed." Power Ventures II, 844 F. Supp. 2d at 1038. Plaintiffs argue that the software hooks, and codes used to take advantage of those hooks, were designed to circumvent any attempts to prevent the Google Defendants from gaining access to Plaintiffs' PII. Plaintiffs, however, have not included any facts that show - or lead to a reasonable inference - that the tracking codes have been designed in such a way to render ineffective any barriers the Plaintiffs might wish to use to prevent access to their PII.
Accordingly, for these reasons the Court GRANTS the Google Defendants' motion to dismiss the CDAFA Claim. Because the Court cannot say it would be an act of futility, it GRANTS Plaintiffs leave to amend this claim.
I. The Court Dismisses the Negligence Claim, with Leave to Amend.
In their sixth claim for relief, Plaintiffs assert a claim for negligence against Google. In order to state a claim for negligence, Plaintiffs must allege facts showing: (1) a legal duty of due care; (2) a breach of that duty; (3) causation; and (4) damages. See, e.g., Williams v. Beachut Nutrition Corp., 185 Cal. App. 3d 135, 141 (1986). The Google Defendants move to dismiss on the basis that Plaintiffs fail to allege facts to satisfy the duty and harm elements of this claim.
In iPhone I and iPhone II, plaintiffs based their negligence claim on facts that Apple owed them a legal duty to protect their personal information in light of its status as proprietor of its App Store. In iPhone I, the court dismissed because "[t]ort law may not be used to supplant private contractual arrangements, and the failure to perform a contractual duty is not a tort, unless that failure involves an independent legal duty." iPhone I, 2011 WL 4403963, at *9. It also found that plaintiffs failed to show "appreciable, non-speculative harm." Id. In iPhone II, the court dismissed the negligence claim with prejudice, because, even if it assumed Apple owed plaintiffs a duty, the plaintiffs' allegations of injury were "either too speculative to support a claim for negligence under California law, or they stem from disappointed expectations from a commercial transaction and thus do not form the basis of a negligence claim." 844 F. Supp. 2d at 1064; cf. In re Sony Gaming Networks and Customer Data Security Breach Litig., - F. Supp. 2d -, 2012 WL 4849054, at *10 (S.D. Cal. Oct. 11, 2012) (dismissing negligence claim where plaintiff failed to allege facts that would overcome economic loss doctrine).
Plaintiffs allege that Google had a duty "to protect their Personal Information and to protect them from the wrongful taking of such information and the wrongful invasion of their privacy," and assert that a "special relationship" existed by virtue of Google's status as proprietor of the Android Market. (See FACC ¶¶ 176-178.) Plaintiffs' negligence claim is nearly identical to the plaintiffs' claims in iPhone I and iPhone II. The Court finds the reasoning of those cases persuasive, and it concludes Plaintiffs fail to state a claim for negligence. See also In re Sony Gaming Networks, - F. Supp. 2d -, 2012 WL 4849054, at *10.
Accordingly, the Court GRANTS Google's motion to dismiss the negligence claim. Because the Court cannot say it would be an act of futility, it GRANTS Plaintiffs leave to amend this claim.
J. The Court Dismisses the Claim for Trespass to Chattels, with Leave to Amend.
In their seventh claim for relief, Plaintiffs assert that the Google Defendants trespassed on their personal property. In order to state a claim for trespass to chattels, Plaintiffs must allege facts showing "an intentional interference with the possession of personal property [that] proximately caused injury." Intel Corp. v. Hamidi, 30 Cal. 4th 1342, 1350-51 (2003). When a plaintiff alleges trespass to a computer system, or a similar device, the plaintiff must show that the purported trespass: (1) either caused physical damage to personal property; (2) impaired the condition, quality or value of personal property; or (3) deprived the plaintiff of the use of personal property for a substantial time. Id. at 1356 (citing Rest. 2d Torts, § 218, pars. (b), (c)).
In the Intel case, the court found that the defendant was entitled to summary judgment on a trespass to chattels claim, because the plaintiff failed to produce any evidence that the defendant's conduct had "any appreciable effect on the operation of its computer system" or that defendant's conduct would be "replicated by others if found not to constitute a trespass." Id. at 1356; see also id. at 1353-56 (reviewing cases and noting that a "defendant's use of [a] plaintiff's computer system was held sufficient to support an action for trespass when it actually did, or threatened to, interfere with the functioning of the system, as by significantly reducing its available memory and processing power").
Here, Plaintiffs allege that when Google collects geolocation data, it causes their batteries to drain more quickly and allege the Google Defendants have installed unwanted code on their phones, which collects PII. (FACC ¶¶ 97, 182-187.) In the iPhone II case, the court dismissed the plaintiffs' claims for trespass to chattels based on allegations that were substantially similar to, if not identical to, the allegations here. Indeed, the plaintiffs in iPhone II alleged that "the Tracking Defendants' repeated actions during App executions utilized approximately two to three seconds of battery capacity with each action due to the power requirements of CPU processing, file input and output actions, and Internet connectivity." (See In re iPhone Application Litig., No. 11-MD-2250-LHK, Docket No. 25, First Amended Consolidated Complaint ("iPhone FACC") ¶ 200.) The court, however, concluded that "[w]hile these allegations conceivably constitute a harm, they do not plausibly establish a significant reduction in service with the intended functioning of the system, which is necessary to establish a cause of action for trespass." iPhone II, 844 F. Supp. 2d at 1069. Plaintiffs do not include any similar facts to support their claim for trespass to chattels. (Compare iPhone FACC ¶¶ 197-202, 296-309 with FACC ¶¶ 97, 182-187.) The Court cannot distinguish the facts of this case from the facts in iPhone II and, thus, it concludes that Plaintiffs have not alleged sufficient facts to state a claim for trespass to chattels.
Accordingly, the Court GRANTS the Google Defendants' motion to dismiss the claim for trespass to chattels. Because the Court cannot say it would be an act of futility, it GRANTS Plaintiffs leave to amend this claim.
For the foregoing reasons, the Court grants, in part, and denies, in part, the Google Defendants' motion to dismiss, denies as moot Plaintiffs' motion to strike, and grants Plaintiffs leave to amend. If Plaintiffs choose to amend, they shall file their amended complaints by April 25, 2013. Although the Court stated that it would set a date for a hearing on the motion for class certification in this order (see Docket No. 9), in light of the uncertain state of the pleadings, the Court will not set a hearing on such a motion until this matter is at issue.
The Google Defendants argue that the Court should dismiss the FACC because Plaintiffs improperly group them together. Although the Court declines to dismiss on that basis, if the Plaintiffs choose to amend, and if they allege conduct that is not common to all of the Google Defendants, they must clearly specify the conduct that forms the basis of a claim against each individual defendant.
It is FURTHER ORDERED that the parties shall appear for a case management conference on May 31, 2013, at 1:30 p.m. The parties shall submit a joint case management statement by no later than May 24, 2013.
IT IS SO ORDERED.
JEFFREY S. WHITE
UNITED STATES DISTRICT JUDGE