Doe v. Microsoft Corporation

THE HONORABLE JOHN C. COUGHENOUR [6] UNITED STATES DISTRICT COURT [7] WESTERN DISTRICT OF WASHINGTON 8 AT SEATTLE 9 JANE DOE, individually and on behalf of all CASE NO. C23-0718-JCC others similarly situated, [10] ORDER 11 Plaintiff, v. [12] MICROSOFT CORPORATION, et al., [13] Defendants. [15] 16 This matter comes before the Court on motions to dismiss by Defendants Qualtrics 17 International Inc. and Qualtrics LLC (together “Qualtrics”) and Defendant Microsoft 18 Corporation (Dkt. Nos. 37, 43). Having thoroughly considered the parties’ briefing and the 19 relevant record, the Court finds oral argument unnecessary and hereby GRANTS in part and 20 DENIES in part the motions for the reasons explained herein. 21 I. BACKGROUND 22 Plaintiff is a California resident who obtains healthcare from Kaiser Permanente 23 (“Kaiser”). (Dkt. No. 1 at 2–3.) She has been a Kaiser member for at least 10 years and has used 24 its website throughout her membership. (Id. at 3.) Unbeknownst to Plaintiff, code within the 25 Kaiser website includes software development kits (“SDKs”) offered by Defendants Qualtrics 26 and Microsoft. (Id. at 9.) Plaintiff alleges that Qualtrics and Microsoft, through these SDKs, 1 “repeatedly and systematically [] violated [her and other Kaiser members’] legally-protected 2 privacy interest by extracting private healthcare and other information from Kaiser Members’ 3 communications with the Kaiser Website.” (Id. at 2.) This includes Kaiser members’ “medical 4 conditions, immunizations, prescriptions, physician information, and other private data, 5 including healthcare search terms, videos watched, and links accessed.” (Id.) Plaintiff further 6 alleges that Defendants used this data together with unique identifiers to identify the Kaiser 7 member associated with the data. (Id. at 2, 9.) According to Plaintiff, Kaiser members had no 8 indication this information is transmitted to Defendants. (Id. at 9.) 9 Plaintiff brings nine causes of action against both Qualtrics and Microsoft: (1) violations 10 of the California Invasion of Privacy Act (“CIPA”) (two counts); (2) violation of the right to 11 privacy under the California Constitution; (3) intrusion upon seclusion under California law; 12 (4) violation of the U.S. Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 , et seq.; 13 (5) unjust enrichment; (6) violation of the California Unfair Competition Law (“UCL”); 14 (7) statutory larceny; and (8) conversion under California law. (Dkt. No. 1 at 33–46.) In 15 response, Qualtrics and Microsoft each move to dismiss the complaint (Dkt. Nos. 37, 43) and, in 16 doing so, seek judicial notice of several exhibits (Dkt. Nos. 38 at 3–5; 43 at 9, 12–13, 24). 17 II. DISCUSSION 18 A. Judicial Notice 19 As an initial matter, Qualtrics asks the Court to consider four exhibits under either the 20 doctrine of judicial notice or the doctrine of incorporation: (1) a Qualtrics webpage titled “How 21 to collect website feedback” (Exhibit 1); (2) a Qualtrics webpage titled “Step 4: Setting Up Your 22 Intercept” (Exhibit 2); (3) Kaiser’s log-in page (Exhibit 3); and (4) Kaiser’s privacy statement 23 (Exhibit 4). (Dkt. No. 38 at 4.) Microsoft similarly asks the Court to take judicial notice of 24 (1) Microsoft’s advertising agreement (Exhibit A), (2) Microsoft’s privacy statement (Exhibit B), 25 (3) Kaiser’s privacy statement (Exhibit C), (4) a Microsoft webpage titled “Universal Event [26] 1 Tracking” (Exhibit E),1 and (5) a bulletin on the U.S. Health & Human Services website titled, 2 “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” 3 (Exhibit F). (Dkt. No. 43 at 9, 12–13, 24.) 4 Generally, courts may not consider material outside of the pleadings when ruling on a 5 motion to dismiss. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001). There are two 6 exceptions to this rule. First, incorporation-by-reference allows courts to treat certain documents 7 as though they are part of the complaint itself. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 8 988, 1002 (9th Cir. 2018). Second, courts may take judicial notice of facts that are “not subject to 9 reasonable dispute because [they] . . . can be accurately and readily determined from sources 10 whose accuracy cannot reasonably be questioned.” U.S. v. Ritchie, 342 F.3d 903 , 908–09 (9th 11 Cir. 2003) (citing Fed. R. Evid. 201(b)). Judicial notice should be taken with reserve, however, 12 as its function is to deprive a party of the opportunity to attack opposing evidence through 13 rebuttal and cross-examination. Rivera v. Philip Morris, Inc., 395 F.3d 1142, 1151 (9th Cir. 14 2005). Furthermore, “[j]ust because the document itself is susceptible to judicial notice does not 15 mean that every assertion of fact within that document is judicially noticeable for its truth.” 16 Khoja, 899 F.3d at 999 . The same is true for websites, which may be judicially noticed for their 17 existence and content, but not for the content’s truth. Threshold Enterprises Ltd. v. Pressed 18 Juicery, Inc., 445 F. Supp. 3d 139 , 146 (N.D. Cal. 2020); see 2Die4Kourt v. Hillair Cap. Mgmt., 19 LLC, 2016 WL 4487895 , slip op. at 1 n.1 (C.D. Cal. 2016) (taking judicial notice of thirty-four 20 online news articles and social media posts “solely for their existence and content, and not for 21 the truth of any statements in the documents”). 22 Here, judicial notice is appropriate with respect to Qualtrics’ Exhibit 3 and Microsoft’s 23 Exhibits E and F. Exhibit 3 is Kaiser’s log-in page, and there is no reasonable dispute as to its 24 authenticity or accuracy. (See generally Dkt. Nos. 52, 55.) Exhibits E and F are public webpages, 25 and Plaintiff does not oppose Microsoft’s request that they be judicially noticed. (See generally 26 1 Microsoft’s motion (Dkt. No. 43) appears to incorrectly refer to this as Exhibit D. 1 Dkt. No. 55.) Furthermore, the complaint incorporates Exhibit F by reference. (See Dkt. No. 1 at 2 6.) For those reasons, the Court GRANTS Defendants’ requests for judicial notice with respect to 3 Exhibits 3, E, and F. 4 Judicial notice is also appropriate with respect to Qualtrics’ Exhibits 1 and 4, and 5 Microsoft Exhibits A, B, and C. Public terms of service and privacy policies are proper subjects 6 of judicial notice. See, e.g., In re Zoom Video Commc’ns Inc. Priv. Litig., 525 F. Supp. 3d 1017 , 7 1026 (N.D. Cal. 2021); Coffee v. Google, LLC, 2021 WL 493387 , slip op. at 3–4 (N.D. Cal. 8 2021); Matera v. Google Inc., 2016 WL 8200619 , slip op. at 5 (N.D. Cal. 2016). Furthermore, 9 Plaintiff does not meaningfully dispute the authenticity or accuracy of these exhibits. (See 10 generally Dkt. Nos. 52, 55.) Accordingly, the Court GRANTS Defendants’ requests for judicial 11 notice with respect to Exhibits 1, 4, A, B, and C.2 12 With respect to Qualtrics’ Exhibit 2, Qualtrics appears to be asking the Court to take 13 judicial notice of the truth of its contents, not merely its existence. (See Dkt. No. 37 at 2) (citing 14 Exhibit 2 for the assertion that “[t]he Site Intercept function does not ‘intercept’ 15 anything . . .”). Such a request is not appropriate under Federal Rule of Evidence 201. See Ang v. 16 Bimbo Bakeries USA, Inc., 2013 WL 5407039 , slip op. at 6 (N.D. Cal. 2013) (declining to take 17 judicial notice of American Heart Association website pages because the defendant requested 18 judicial notice of the truth of the contents of those pages). Accordingly, the Court DENIES 19 Qualtrics’ request for judicial notice with respect to Exhibit 2. 20 B. Standing 21 In general, to establish standing, “a plaintiff must show (i) that [s]he suffered an injury in 22 fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused [23] 2 However, the Court only takes “judicial notice of the fact that these documents exist, ‘not 24 whether, for example, the documents are valid or binding [].’” Opperman v. Path, Inc., 84 F. Supp. 3d 962, 975 (N.D. Cal. 2015) (quoting Datel Holdings Ltd. v. Microsoft Corp., 712 F. 25 Supp. 2d 974, 984 (N.D. Cal. 2010)). The Court further notes that while these disclosures appear to be the most recent terms and policies, there is no indication that they existed throughout the [26] last 10 years (during which Plaintiff allegedly used the Kaiser website). 1 by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” 2 TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). This must be shown “for each claim 3 that they press and for each form of relief that they seek.” Id. at 2208 . At the pleading stage, 4 “general factual allegations of injury resulting from the defendant’s conduct may suffice.” Lujan 5 v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) (internal citations omitted). This is not an 6 onerous burden, though, “for on a motion to dismiss we presum[e] that general allegations 7 embrace those specific facts that are necessary to support the claim.” Id. 8 Qualtrics contends that Plaintiff lacks standing because (a) she relies on group 9 allegations, rather than alleging conduct traceable to Qualtrics (versus Microsoft); (b) she fails to 10 allege the collected data is identifying of her (rather than anonymized), thereby failing to allege 11 an injury in fact for her privacy claims (counts I–IV); and (c) she fails to allege any economic 12 loss, as required to assert her remaining claims (counts V–IX). (Dkt. No. 37 at 14–17.) None of 13 these arguments are persuasive. 14 First, Plaintiff adequately alleges conduct traceable to Qualtrics. Indeed, the complaint 15 specifically identifies how Qualtrics’ SDK intercepts Kaiser members’ private data and the types 16 of data it intercepts. (See Dkt. No. 1 at 9, 16–23.)3 This is sufficient to allege conduct traceable 17 to Qualtrics. See In re Static Random Access Memory (SRAM) Antitrust Litig., 580 F. Supp. 2d 18 896, 904 (N.D. Cal. 2008) (“Although Plaintiffs will need to provide evidence of each 19 Defendants’ participation in any conspiracy, they now only need to make allegations that 20 plausibly suggest that each Defendant participated in the alleged conspiracy.”). That the 21 complaint also alleges conduct equally traceable to Microsoft does not render those allegations 22 improper “group allegations.” See Tivoli LLC v. Sankey, 2015 WL 12683801 , slip op. at 3 (C.D. 23 Cal. 2015 ) (“Group pleading is not fatal to a complaint if the complaint still gives defendants fair 24 notice of the claims against them.”). [25] 3 Separately, the complaint also discusses Microsoft’s allegedly unlawful conduct. (See id. at 9– [26] 16). 1 Second, Plaintiff repeatedly alleges that “the unique user identifiers allow Qualtrics to 2 link” a Kaiser member’s private data “to a specific user and identify the user.” (Dkt. No. 1 at 17– 3 23) (emphasis added). Construing the complaint liberally, as the Court must, this is sufficient to 4 allege that Qualtrics collects non-anonymized data, thereby giving rise to an injury in fact. See 5 Warth v. Seldin, 422 U.S. 490, 501 (1975) (“For purposes of ruling on a motion to dismiss for 6 want of standing, [courts] must accept as true all material allegations of the complaint and must 7 construe the complaint in favor of the complaining party.”).4 8 Third and finally, Plaintiff alleges economic loss in two ways: (a) the unlawful taking and 9 use of her private data, which is inherently valuable; and (b) the diminution of the value of that 10 data. (See Dkt. No. 1 at 25, 28, 42, 45.) Qualtrics argues that such losses are insufficient to 11 confer standing, and that Plaintiff must instead allege that she planned to sell her data, or that her 12 data was made less valuable due to Qualtrics’ use of it. (Dkt. No. 37 at 16–17.) Although the 13 Court disagrees, this argument merits further discussion. 14 “[S]tate law can create interests that support standing in federal courts.” Cantrell v. City 15 of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001). As relevant here, California law recognizes a 16 right to disgorgement of profits resulting from unjust enrichment, even where an individual has 17 not suffered a corresponding loss. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 , 18 599 (9th Cir. 2020) [hereinafter Facebook Tracking]. Thus, to establish standing, Plaintiff must 19 allege she retains a stake in the profits garnered from her personal data because “the [20] 4 Relatedly, Microsoft notified this Court of a recent decision in Adams v. PSP Group, LLC, [21] 2023 WL 5951784 (E.D. Mo. 2023), asserting that it addresses various issues raised in Microsoft’s motion to dismiss. (Dkt. No. 59.) In Adams, the court dismissed a case challenging [22] the use of Microsoft session replay software for failure to plead a concrete injury sufficient to confer Article III standing. 2023 WL 5951784 , slip op. at 1. But this case is clearly [23] distinguishable. Whereas the plaintiff in Adams “[did] not allege or describe what information 24 Plaintiff provided to Defendant while she was visiting its website,” (id. at 16), Plaintiff here does so extensively. (See Dkt. No. 1 at 9–16) (alleging that Microsoft collected Kaiser members’ 25 search terms, visited webpages, viewed videos, prescriptions, medical conditions, immunization records, and allergies to link each member to a specific user and identify the user). Accordingly, [26] Adams does not change the Court’s conclusion. 1 circumstances are such that, as between the two [parties], it is unjust for [Qualtrics] to retain it.” [2] Id. at 600 (citing McBride v. Boughton, 20 Cal. Rptr. 3d 115, 122 (2004)) (emphasis in original). 3 Here, Plaintiff adequately pleads an entitlement to Qualtrics’ profits from users’ personal 4 data. Specifically, she alleges that her personal data carries financial value and cites to numerous 5 articles and studies describing the growing market for personal data, including personal health 6 data. (Dkt. No. 1 at 23–28.) Furthermore, Plaintiff alleges that Qualtrics profited from this data 7 and, in fact, used the data for targeted advertising, generating revenue and profits. (Id. at 42–45.) 8 And according to Plaintiff, Qualtrics’ actions diminished the value of her data. (Id. at 28.) 9 Combined, these allegations are sufficient to confer standing under Facebook Tracking. See Ji v. 10 Naver Corp., 2023 WL 6466211 , slip op. at 6 (N.D. Cal. 2023) (finding the plaintiffs’ 11 “diminution of value” theory of economic injury sufficient to confer standing). 12 Accordingly, the Court FINDS that Plaintiff has sufficiently pleaded an injury to support 13 standing for the relief sought. 14 C. Failure to State a Claim 15 Next, Defendants challenge the factual sufficiency of the complaint as a whole, as well as 16 each of Plaintiff’s individual claims. The Court considers each in turn. 17 1. Legal Standard 18 Dismissal is proper when a plaintiff “fails to state a claim upon which relief can be 19 granted.” Fed. R. Civ. P. 12(b)(6). To survive a motion to dismiss, a complaint must contain 20 sufficient factual matter, accepted as true, to state a claim for relief that is plausible on its face. 21 Ashcroft v. Iqbal, 556 U.S. 662 , 677–78 (2009). A plaintiff is obligated to provide grounds for 22 their entitlement to relief that amount to more than labels and conclusions or a formulaic 23 recitation of the elements of a cause of action. Bell Atl. Corp. v. Twombly, 550 U.S. 544 , 545 24 (2007). A claim has facial plausibility when the plaintiff pleads factual content5 that allows the [25] 5 Although the Court must accept as true a complaint’s well-pleaded facts, conclusory allegations 26 of law and unwarranted inferences will not defeat an otherwise proper Rule 12(b)(6) motion. See, 1 court to draw the reasonable inference that the defendant is liable for the misconduct alleged. 2 Iqbal, 556 U.S. at 678 . “[T]he pleading standard Rule 8 announces does not require ‘detailed 3 factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed4 me accusation.” Id. (citing Twombly, 550 U.S. at 555 ). Dismissal under Rule 12(b)(6) “can [also] 5 be based on the lack of a cognizable legal theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d 6 696, 699 (9th Cir. 1988). 7 2. Factual Sufficiency 8 Qualtrics and Microsoft challenge the adequacy of the complaint’s factual allegations 9 under Rule 8. Specifically, Qualtrics argues that Plaintiff fails to plead when she used the Kaiser 10 website and thus was exposed to Qualtrics’ alleged data collection. (Dkt. No. 37 at 18.) 11 Microsoft similarly argues that Plaintiff fails to allege facts plausibly showing she was 12 personally affected by Microsoft’s alleged conduct, including the dates she used the Kaiser 13 website and facts showing Kaiser disclosed her data in a manner that allowed Microsoft to 14 identify her personally. (Dkt. No. 43 at 15–16.) Neither argument is convincing. 15 Rule 8 requires that a complaint “contain sufficient allegations of underlying facts to give 16 fair notice and to enable the opposing party to defend itself effectively.” Starr v. Baca, 652 F.3d 17 1202, 1216 (9th Cir. 2011). Courts do at times “dismiss claims under Rule 8 when plaintiffs fail 18 to allege approximately when the actionable misconduct occurred.” Brodsky v. Apple Inc., 445 F. 19 Supp. 3d 110, 135 (N.D. Cal. 2020). But “a failure to plead when any alleged misconduct 20 occurred will not necessarily be fatal under Rule 8.” Id. Instead, a plaintiff’s “repeated failure to 21 plead the approximate date of alleged misconduct fails to satisfy Rule 8” in certain 22 circumstances, such as “where . . . an applicable statute of limitations defense has been raised 23 and is non-frivolous” Id. 24 Here, Plaintiff alleges she “has been a Kaiser Member for at least 10 years and has used [25] e.g., Vasquez v. Los Angeles Cnty., 487 F.3d 1246 , 1249 (9th Cir. 2007); Sprewell v. Golden [26] State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). 1 the Kaiser Website throughout her membership.” (Dkt. No. 1 at 3, 28.) She claims that while 2 logged into that account, “she used the search function; accessed immunization and medical 3 records; made appointments; reviewed physical information; reviewed medical conditions; and 4 watched videos,” and that when she did, “Defendants unlawfully intercepted and collected such 5 data along with her personal identifiers.” (Id.) This is sufficient under Rule 8, particularly in light 6 of Defendants’ failure to raise a non-frivolous statute of limitations defense.6 Accordingly, the 7 Court DENIES Defendants’ motions on these grounds.7 8 3. Consent 9 Qualtrics next argues Plaintiff’s claims must be dismissed because she consented to 10 Qualtrics’ collection of her data. (Dkt. No. 37 at 19–20.) Consent “can be explicit or implied, but 11 any consent must be actual.” Calhoun v. Google LLC, 526 F. Supp. 3d 605 , 620 (N.D. Cal. 12 2021). For consent to be actual, the disclosures must “explicitly notify” users of the practice at 13 issue. Id.; see also Campbell v. Facebook, Inc., 77 F. Supp. 3d 836 , 847–48 (N.D. Cal. 2014) 14 (explaining that, for a finding of consent, the disclosures must have given users notice of the 15 “specific practice” at issue). And the disclosures must have only one plausible interpretation. In [16] 6 In arguing factual insufficiency under Rule 8, Qualtrics raises the possibility of a statute of [17] limitations defense. (Dkt. No. 37 at 18.) Generally, the statute of limitations commences when a 18 cause of action “accrues.” Bernson v. Browning-Ferris Indus., 871 P.2d 613 , 615 (Cal. 1994). But under the common law “discovery rule,” the accrual date may be “delayed until the plaintiff 19 is aware of her injury.” Id. (citation omitted). A plaintiff is held to her actual knowledge as well as knowledge that could reasonably be discovered through investigation of sources open to her. [20] Jolly v. Eli Lilly & Co., 751 P.2d 923, 927 (Cal. 1988). Here, Plaintiff alleges that she and class 21 members “could not with due diligence have discovered the full scope of Defendants’ conduct” because Defendants’ SDKs were highly technical and there was no indication that would alert a 22 reasonable consumer of Defendants’ data collection and interception. (Dkt. No. 1 at 29.) According to the complaint, “[t]he earliest Plaintiff and Class Members could have known about 23 Defendants’ conduct was shortly before the filing of this Complaint.” (Id.) Accepting Plaintiff’s allegations as true, the delayed discovery rule tolls the statute of limitations, making the specific [24] timing of alleged misconduct irrelevant to the analysis. 25 7 As for Microsoft’s argument that Plaintiff fails to allege facts showing Microsoft could identify her personally: this is another iteration of Qualtrics’ standing argument, and the Court denies it [26] for the same reasons. See supra Part II.B. 1 re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767 , 794 (N.D. Cal. 2 2019).8 Finally, Qualtrics bears the burden of showing consent. See Calhoun, 526 F. Supp. 3d at 3 620. 4 Qualtrics asserts the Kaiser website “advises users that by logging in, they accept 5 Kaiser’s Term & Conditions and Privacy Statement.” (Dkt. No. 37 at 19.) The privacy statement, 6 in turn, informs users that Kaiser may “disclose your personal information to third parties who 7 provide services on our behalf to help with our business activities,” and that Kaiser and its 8 “service providers may place Internet ‘cookies’ or similar technologies . . . on the computer hard 9 drives of visitors to the Site.” (Id. at 19–20.) This, according to Qualtrics, shows that any logged10 in Kaiser user consented to the data collection at issue in this case. (Id. at 20.) 11 But Plaintiffs’ claims do not hinge on a Kaiser user being logged in to her account, as 12 Plaintiff expressly alleges that Qualtrics collects certain categories of data “regardless of whether 13 the user is logged in to her Kaiser Account.” (Dkt. No. 1 at 19.) Thus, even if Kaiser’s 14 disclosures at log-in indicate consent to some of the allegedly unlawful data collection, they do 15 not indicate consent to all of it. 16 Moreover, the Court is skeptical that a reasonable user who viewed Kaiser’s policies 17 would have understood that Qualtrics was collecting protected health information. In In re Meta 18 Pixel Healthcare Lit., for example, the court found no consent where Meta’s policies indicated 19 that Meta collects users’ personal data, but “do not . . . specifically indicate that Meta may 20 acquire health data obtained from Facebook users’ interactions with their medical providers’ 21 websites.” 647 F. Supp. 3d 778 , 793 (N.D. Cal. 2022) (emphasis in original). Such notice, the 22 court concluded, was too generalized to establish consent. Id. The same holds true here. 23 Although Kaiser informed users that it may disclose “personal information to third parties,” a [24] 8 “[I]f a reasonable . . . user could have plausibly interpreted the contract language as not 25 disclosing that [the defendant] would engage in particular conduct, then [the defendant] cannot obtain dismissal of a claim about that conduct (at least not based on the issue of consent).” Id. at [26] 789–90. 1 reasonable user would not have understood this to include personal health information. (See Dkt. 2 No. 37 at 19.) That this case involves Kaiser (a health care provider) rather than Meta (a tech 3 company) does not persuade the Court otherwise, particularly in light of the sensitive nature of 4 the data at issue (which includes Plaintiff’s prescriptions, medical conditions, immunizations, 5 allergies, search queries, and unique identifiers). (See Dkt. No. 1 at 16–23.) 6 Accordingly, Qualtrics’ motion to dismiss based on consent is DENIED. 7 D. Privacy Claims 8 1. California Invasion of Privacy Act 9 Plaintiff claims Defendants violated two provisions of CIPA: § 631(a) (the wiretapping 10 provision) and § 632 (the recording provision). 11 a. Section 631(a) 12 CIPA § 631(a) prohibits “three distinct and mutually independent patterns of conduct”: 13 (1) intentional wiretapping; (2) willfully attempting to learn the contents or meaning of a 14 communication in transit over a wire; and (3) attempting to use or communicate information 15 obtained as a result of engaging in either of the two previous activities. Mastel v. Miniclip SA, [16] 549 F. Supp. 3d 1129 , 1134 (E.D. Cal. 2021). Under the participant exception, however, parties 17 to a communication are exempt from liability. Facebook Tracking, 956 F.3d at 607; see also 18 Warden v. Kahn, 160 Cal. Rptr. 471, 475 (1979) (“[S]ection 631 . . . has been held to apply only 19 to eavesdropping by a third party and not to recording by a participant to a conversation.”). 20 Qualtrics argues it acted merely as an extension of Kaiser, and therefore, was a 21 participant rather than an eavesdropper. (Dkt. No 37 at 20–22.) Lower courts are split as to 22 whether a software provider falls within the party exception. Compare Revitch v. New Moosejaw, 23 LLC, 2019 WL 5485330 , slip op. at 1 (N.D. Cal. 2019) (holding that defendant “acted as a third 24 party” for CIPA purposes), with Graham v. Noom, 533 F. Supp. 3d 823 , 832 (N.D. Cal. 2021) 25 (holding that software vendors are extensions of the websites that employ them, and thus not [26] 1 third parties for CIPA purposes).9 But even if the Court were to adopt the Graham approach, as 2 Qualtrics urges, Plaintiff adequately alleges that Qualtrics used her data for its own benefit. (Dkt. 3 No. 1 at 42–43) (“[Defendants’] benefits include . . . the revenue and profits resulting from the 4 targeted advertising and other uses of such data by Defendants.”). Accordingly, Qualtrics’ 5 argument that it is a mere “extension” of Kaiser does not provide a basis for dismissal at this 6 stage. 7 Microsoft argues Plaintiff’s § 631(a) claim fails because she does not claim Microsoft 8 tapped or intercepted her communications with “any telegraph or telephone wire, line, cable, or 9 instrument.” (Dkt. No. 43 at 20–21); see Cal. Penal Code § 631 (a). To the extent Plaintiff alleges 10 intentional wiretapping under the first clause of § 631(a), the Court agrees. As Microsoft 11 correctly notes, courts have strictly construed the “telegraph or telephone” component of 12 § 631(a)’s intentional wiretapping clause. See, e.g., In re Google Assistant Privacy Litig., 457 F. 13 Supp. 3d 797, 825 (N.D. Cal. 2020) (“The first clause expressly requires that the unauthorized 14 connection be made with any telegraph or telephone wire, line, cable, or instrument.”) 15 (quotations omitted); Matera v. Google Inc., 2016 WL 8200619 , slip op. at 18 (N.D. Cal. 2016) 16 (same). Here, Plaintiff does not suggest that Defendants tapped her communications using 17 telegraph or telephone wires, besides a conclusory statement that “Defendants . . . intercept[ed] 18 [her] Private Data . . . while the same was in transit or passing over any wire, line, or cable . . . .” 19 (Dkt. No. 1 at 34.) 20 Thus, Plaintiff fails to state a § 631(a) claim against both Defendants, but only to the 21 extent she bases her claim on intentional wiretapping. [23] 9 Although in Graham, Judge Beeler distinguished the Moosejaw line of cases, explaining that 24 those involved third parties who allegedly used the data for their own benefit (rather than for the sole benefit of the party to the communication). Id. But as Judge Breyer later explained in Javier 25 v. Assurance IQ, LLC, “reading a use requirement into the second prong would add requirements that are not present (and swallow the third prong in the process).” 649 F. Supp. 3d 891 , 900 [26] (N.D. Cal. 2023). 1 b. Section 632 2 CIPA § 632 imposes liability on “[a] person who, intentionally and without the consent 3 of all parties to a confidential communication, uses an electronic amplifying or recording device 4 to eavesdrop upon or record the confidential communication” of another. Cal. Penal Code 5 § 632(a). Defendants each argue for dismissal of Plaintiff’s § 632(a) claim. 6 Microsoft argues the claim fails because Plaintiff does not allege that Microsoft used any 7 “electronic amplifying or recording device” to record her information. (Dkt. No. 43 at 21–22.) 8 The Court agrees, to some extent. “Software like Google Maps, Chrome, etc. are not ‘devices’ 9 within the meaning of CIPA because they are not ‘equipment.’” In re Google Location Hist. 10 Litig., 428 F. Supp. 3d 185, 193 (N.D. Cal. 2019) (citing Moreno v. San Francisco Bay Area 11 Rapid Transit Dist., 2017 WL 6387764 , slip op. at 5 (N.D. Cal. 2017)). But servers are distinct. 12 See, e.g., Brown v. Google LLC, 525 F.Supp.3d 1049 , 1064, 1073–74 (N.D. Cal. 2021). And 13 although Plaintiff asserts that “Defendants violated CIPA by using their SDKs and receiving 14 servers,” the complaint alleges that only Qualtrics used such servers (whereas Microsoft used 15 software). (Dkt. No. 1 at 17–18.)10 Because software does not constitute a “device” under the 16 CIPA, Plaintiff’s § 632 claim against Microsoft is deficient. 17 Qualtrics argues Plaintiff’s § 632 claim fails because (i) it was Kaiser (not Qualtrics) that 18 “used” the recording device, and (ii) Qualtrics did not intend to record confidential 19 communications without consent. (Dkt. No. 37 at 22–23.) The first argument is unpersuasive 20 because Plaintiff adequately pleads Qualtrics’ use of a recording device. (See Dkt. No. 1 at 17– [22] 10 The Court has permitted Plaintiff’s references to “Defendants” rather than Microsoft and [23] Qualtrics individually throughout the complaint, see supra Part II.B. However, it will not go as 24 far as to assume such allegations apply to both Defendants equally where the factual allegations specific to Microsoft and Qualtrics diverge. Here, only the “Qualtrics” section of the complaint 25 contains an explicit reference to “servers” (Dkt. No. 1 at 17–18), whereas the “Microsoft” section refers only to “software” (Id. at 9). Accordingly, the Court interprets this to mean only [26] Qualtrics is alleged to have used a server. 1 18) (detailing Qualtrics’ use of servers to collect user data).11 As for the second argument, 2 Qualtrics’ reliance on Federated Univ. Police Officers’ Ass’n v. Regents of the Univ. of Cal. is 3 inapposite. 2015 WL 13273308 (C.D. Cal. 2015). There, the court dismissed a CIPA claim 4 against a retailer that did little more than “sell and install [a] recording system” at a police 5 department. Id. at 10 . Such minimal involvement, the court held, was insufficient to suggest the 6 retailer “acted intentionally in eavesdropping . . . .” Id. In contrast, Plaintiff here alleges far more 7 involvement by Qualtrics, including that Qualtrics’ SDK collected and forwarded Plaintiff’s 8 personal health information to Qualtrics’ servers. (Dkt. No. 1 at 17–18.) This is sufficient to 9 show intent to record confidential communications at the dismissal stage. 10 c. Microsoft’s Remaining CIPA Arguments 11 Finally, Microsoft argues both of Plaintiff’s CIPA claims fail because she does not allege 12 facts showing Microsoft intercepted the contents of her communications with Kaiser, as is 13 required under CIPA. (Dkt. No. 43 at 17–19.) Microsoft points to In re Zynga Privacy Litigation, 14 where the Ninth Circuit found that URLs which merely included basic identification and address 15 information did not constitute contents of a communication. 750 F.3d 1098 , 1109 (9th Cir. 16 2014).12 But Zynga itself distinguishes such URLs from those that disclose contents because they 17 “show[] the specific search terms the user had communicated . . . .” Id. at 1108–09. And here, 18 Plaintiff alleges Microsoft collects URLs containing search queries that could divulge a user’s 19 medical conditions, allergies, and immunizations. (Dkt. No. 1 at 10, 13–16.) Accordingly, 20 Plaintiff has adequately pled that Microsoft intercepted the contents of her communication with [22] 11 Notably, “[Qualtrics] identif[ies] no authority suggesting that [it] cannot be held liable for 23 eavesdropping because a third party . . . participated in the installation of [Qualtrics’] code that sends information to [Qualtrics].” Griffith v. Tiktok, Inc., 2023 WL 7107262 , slip op. at 7 (C.D. 24 Cal. 2023 ). 25 12 Although Zynga analyzed communication under the federal Wiretap Act, 18 U.S.C. § 2511 (3), the same analysis applies under CIPA. See Cline v. Reetz-Laiolo, 329 F. Supp. 3d 1000 , 1051 [26] (N.D. Cal. 2018). 1 Kaiser for purposes of CIPA.13 2 In summary, the Court DISMISSES Plaintiff’s CIPA § 632 claim against Microsoft, as 3 well as her CIPA § 631(a) claim against both Defendants (but only to the extent she bases thon 4 intentional wiretapping. Plaintiff’s remaining CIPA claims survive. 5 2. California Constitution & Common Law Intrusion Upon Seclusion 6 To state a claim for intrusion upon seclusion under California common law, a plaintiff 7 must plead that (1) the defendant intentionally intruded into a place, conversation, or matter as to 8 which the plaintiff has a reasonable expectation of privacy, and (2) the intrusion occurred in a 9 manner highly offensive to a reasonable person. Facebook Tracking, 956 F.3d at 601 (citing 10 Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1072 (2009)). A claim for invasion of privacy under 11 the California Constitution involves similar elements: a plaintiff must show that (1) they possess 12 a legally protected privacy interest, (2) they maintain a reasonable expectation of privacy, and (3) 13 the intrusion is “so serious . . . as to constitute an egregious breach of the social norms” such that 14 the breach is “highly offensive.” Id. Because the tests are similar, courts typically consider the 15 claims together and ask (1) whether there exists a reasonable expectation of privacy, and (2) 16 whether the intrusion was highly offensive. Id. Qualtrics and Microsoft raise various arguments 17 in support of their motions to dismiss each claim, which the Court discusses in turn. 18 a. Qualtrics 19 Two of Qualtrics’ arguments are foreclosed by the rulings above. First, Qualtrics asserts 20 that Plaintiff’s invasion of privacy and intrusion upon seclusion claims fail “because Qualtrics is 21 merely an extension of Kaiser.” (Dkt. No. 37 at 24, 26.) The Court has already rejected this [22] 13 Separately, Microsoft asks the Court to dismiss Plaintiff’s CIPA, UCL, and unjust enrichment [23] claims as to non-California residents, arguing these claims do not apply extraterritorially and the 24 alleged conduct occurred outside of California. (Dkt. No. 43 at 22, 29.) Because this request is premature, the Court will not address it at this juncture. Clancy v. The Bromley Tea Co., 308 25 F.R.D. 564 , 572 (N.D. Cal. 2013) (“[A] detailed choice-of-law analysis is not appropriate at this stage of litigation. Rather, such a fact-heavy inquiry should occur during the class certification [26] stage, after discovery.”). 1 argument and will not readdress it here. See supra Part II.D(1)(a). Second, Qualtrics argues 2 Plaintiff lacked a reasonable expectation of privacy “because she consented to Kaiser’s Privacy 3 Policy, which disclosed that data is shared with third-party partners . . . .” (Dkt. No. 37 at 24, 26.) 4 Again, the Court has rejected this consent-based argument. See supra Part II.C(3). 5 Qualtrics also argues Plaintiff had no legally protected privacy interest “where defendant 6 has only collected browsing data from one site, as opposed to across the Internet.” (Dkt. No. 37 7 at 24.) But the cases Qualtrics cites for this proposition are inapposite. Those courts’ refusal to 8 find a privacy interest did not hinge on the defendants collecting data from only a single site; 9 rather, it hinged on the defendants’ role as operators of the site through which they allegedly 10 collected data. See Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073 , 1086 (C.D. Cal. 2021); 11 In re Google Location Hist. Litig., 428 F. Supp. 3d 185 , 198 (N.D. Cal. 2019). As the Yoon court 12 explained, “courts have been less willing to find that users have a cognizable privacy interest in 13 browsing data collected only while users interact with the website of the defendant company.” 14 549 F. Supp. 3d at 1086 (emphasis added). And here, Qualtrics is not the website owner; Kaiser 15 is.14 Accordingly, the Court rejects this argument. 16 Qualtrics next argues that the data collection at issue was not highly offensive because 17 (i) it involved only anonymized data, (ii) it was merely routine, and (iii) there was no improper 18 use of the data. (Dkt. No. 37 at 25–26) (citing Folgelstrom v. Lamps Plus, Inc., 125 Cal. Rptr. 3d 19 260 (2011)). The Court has already concluded that Plaintiff adequately alleges non-anonymized 20 data collection, see supra Part II.B, and Qualtrics’ remaining arguments are unpersuasive. 21 Qualtrics’ relies on Folgestrom, a case that other courts have distinguished where “the data at 22 issue [] is more private than a person’s mailing address and this kind of intrusion is not routine 23 commercial behavior.” Opperman v. Path, Inc., 205 F. Supp. 3d 1064 , 1078 (N.D. Cal. 2016). 24 And here, the data at issue is Plaintiff’s personal health information. Fundamentally, “[t]he 25 ultimate question of whether [Defendants’] tracking and collection practices could highly offend 26 14 Had Plaintiff brought this suit against Kaiser, the cited cases may have been more persuasive. 1 a reasonable individual is an issue that cannot be resolved at the pleading stage.” Facebook 2 Tracking, 956 F.3d at 606. 3 b. Microsoft 4 Microsoft’s first argument15 puts at issue the contents of Plaintiff’s communications. 5 (See Dkt. No. 43 at 17–19.) This is a regurgitation of its prior argument, which the Court rejects 6 for the same reasons it did above. See supra Part II.D(1). 7 Microsoft next argues Plaintiff lacked a reasonable expectation of privacy before logging 8 into the Kaiser website (because the data collected is not protected health information) and after 9 logging in (because Kaiser’s Privacy Statement discloses data collection). (Dkt. No. 43 at 24.) As 10 previously stated, the Court is not convinced that Kaiser’s Privacy Statement indicates full 11 consent to Defendants’ alleged data collection. See supra Part II.C(3).16 12 Finally, Microsoft argues Plaintiff’s claims fail because she “does not allege that any 13 privacy invasion was ‘sufficiently serious’” such that it evidences an “intent of committing 14 theft,” nor does she plead “facts showing Microsoft used the data in a highly offensive manner.” 15 (Dkt. No. 43 at 24–25.) Again, the Court is unpersuaded. First, Microsoft’s cited legal authority 16 does not support its assertion that Plaintiff must plead Microsoft “intended to steal her data.” See 17 generally, Razuki v. Caliber Home Loans, Inc., 2018 WL 2761818 , slip op. at 2 (S.D. Cal. 2018). 18 Second, “[t]he ultimate question of whether [Defendants’] tracking and collection practices could 19 highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.” 20 15 Microsoft also contends Plaintiff’s claims lack specificity and are set in conclusory terms. 21 (Dkt. No. 43 at 23–24.) But the Ninth Circuit has not required more than Plaintiff has alleged. See Facebook Tracking, 956 F.3d at 603 (rejecting Facebook’s claim that “Plaintiffs need to 22 identify specific, sensitive information that Facebook collected, and that their more general allegation that Facebook acquired ‘an enormous amount of individualized data’ is insufficient”). 23 The Court therefore rejects that argument. 24 16 Because Plaintiff plausibly alleges a constitutional violation and intrusion upon seclusion, it is unnecessary for the Court to decide at the pleading stage whether Plaintiff had a reasonable 25 expectation of privacy prior to logging into the Kaiser website. Rule 12(b)(6) “does not provide a mechanism for dismissing only a portion of a claim.” Franklin v. Midwest Recovery Sys., LLC, [26] 2020 WL 3213676 , slip op. at 1 (C.D. Cal. 2020) (collecting cases). 1 Facebook Tracking, 956 F.3d at 606. At this stage, Plaintiff’s allegations that Defendants 2 intercepted and collected Plaintiff’s protected health information and personally identifiable 3 information are sufficient to survive dismissal. 4 In sum, Plaintiff has sufficiently pleaded the “reasonable expectation of privacy” and 5 “highly offensive” elements necessary to state a claim for intrusion upon seclusion and invasion 6 of privacy. The Court thus DENIES Defendants’ motions to dismiss these claims. 7 3. CFAA 8 “[T]he CFAA is an anti-hacking statute, not an expansive misappropriation statute.” 9 Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1263 (9th Cir. 2019) (quotations omitted). The 10 statute makes it unlawful to, among other things, “intentionally access[] a computer without 11 authorization” and obtain “information from any protected computer.” 18 U.S.C. § 1030 (a)(2). 12 For civil liability to attach, a plaintiff must allege a violation involving one of the five factors 13 listed in § 1030(a)(5)(B). Id. § 1030(g). Here, Plaintiff relies on two of the factors: that the 14 offense caused “loss to 1 or more persons during any 1-year period . . . aggregating at least 15 $5,000 in value,” see id. § 1030(a)(4)(A)(i)(I), and that the offense caused “a threat to public 16 health or safety,” see id. § 1030(a)(4)(A)(i)(IV). (Dkt. No. 1 at 42). 17 Defendants argue that Plaintiff has not alleged sufficient loss to maintain her CFAA 18 claim under the first factor. (Dkt. Nos. 37 at 28–29, 43 at 26–27.) The Court agrees. A “loss” 19 under the CFAA is “any reasonable cost to any victim, including the cost of responding to an 20 offense, conducting a damage assessment, and restoring the data, program, system, or 21 information to its condition prior to the offense, and any revenue lost, cost incurred, or other 22 consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030 (e)(11). 23 Here, Plaintiff’s sole alleged loss is based on “diminution in value” of her private data. (Dkt. No. 24 1 at 42.) This is insufficient under the CFAA, which “clearly limits [‘loss’] to harms caused by 25 computer intrusions, not general injuries unrelated to the hacking itself.” Andrews, 932 F.3d at 26 1263; see Cottle v. Plaid, Inc., 536 F. Supp. 3d 461 , 486 (N.D. Cal. 2021) (concluding that 1 Andrews forecloses the diminution of value theory for CFAA claims). Furthermore, Plaintiff’s 2 reference to the “damage” she allegedly suffered is misplaced, as § 1030(a)(4)(A)(i)(I) refers 3 only to “loss” (which is distinct from “damage” under the CFAA). Compare 18 U.S.C. 4 § 1030(e)(8) (defining “damage”), with 18 U.S.C. § 1030 (e)(11) (defining “loss”). Accordingly, 5 Plaintiff fails to state a CFAA claim based on the first factor.17 6 As to the second factor, Plaintiff makes a conclusory allegation that Defendants’ conduct 7 “constitutes ‘a threat to public health or safety’ under 18 U.S.C. § 1030 (c)(4)(A)(i)(IV),” but 8 fails to include specific factual allegations to support that theory of CFAA liability. 9 Because Plaintiff has not plausibly alleged a “loss” under the CFAA, Defendants’ 10 motions to dismiss these claims are GRANTED. 11 E. Remaining Claims 12 1. Unjust Enrichment 13 California18 courts are divided as to whether a plaintiff can assert unjust enrichment as a 14 standalone cause of action (as opposed to an alternative mechanism for relief). ESG Cap. 15 Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016) (comparing cases); see also Grausz 16 v. Hershey Co., 2023 WL 6206449 , slip op. at 8 (S.D. Cal. 2023) (collecting Ninth Circuit 17 decisions demonstrating the uncertainty). However, the most recently published Ninth Circuit [18] 17 As an alternative theory, Plaintiff also asserts she and class members “suffered loss of at least 19 $5,000 in the form of retaining a technical expert to investigate Microsoft’s surreptitious interception and collection of their data in order to ‘respond[] to an offense’ and to ‘to restor[e] [20] the data . . . to its condition prior to the offense.” (Dkt. Nos. 54 at 26–27, 55 at 24.) There are two 21 problems with this theory. First, Plaintiff failed to raise it in the complaint. (See generally Dkt. No. 1.) Second, even if Plaintiff had included it in the complaint, the Court is not convinced that 22 this theory would meet the CFAA’s “loss” requirement. As the Supreme Court explained in Van Buren v. United States, 141 S. Ct. 1648 , 1659–60 (2021), “the statutory definition[] of . . . ‘loss’ 23 [] focus[es] on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.” Plaintiff’s hiring of a “technical expert” for [24] investigation purposes does not fit this definition. 25 18 Because the complaint asserts that “California substantive law applies to every member of the Class,” (Dkt. No. 1 at 32), the Court treats the unjust enrichment claim as one brought under [26] California common law. 1 case on the issue noted that an unjust enrichment claim may proceed “as an independent cause of 2 action or as a quasi-contract claim for restitution.” ESG Cap. Partners, 828 F.3d at 1038 . To 3 allege unjust enrichment as an independent cause of action, a plaintiff must show the defendant 4 received and unjustly retained a benefit at the plaintiff’s expense. Id. at 1038–39 (citing 5 Lectrodryer v. SeoulBank, 91 Cal. Rptr. 2d 881, 883 (2000)). Here, Plaintiff alleges Defendants 6 intercepted and collected her private data without her consent, that Defendants benefitted from 7 the “revenues and profits resulting from targeted advertising and other uses of such data,” and 8 that this “diminished the value of that Private Data.” (Dkt. No. 1 at 28, 42–43.) This is sufficient 9 to plead that Defendants received and unjustly retained a benefit at Plaintiff’s expense. 10 Accordingly, Defendants’ motions to dismiss Plaintiff’s unjust enrichment claim are DENIED.19 11 2. UCL 12 The UCL prohibits “any unlawful, unfair or fraudulent business act or practice.” Cal. 13 Bus. & Prof. Code § 17200. Each of the three UCL prongs provides a “separate and distinct 14 theory of liability” and an independent basis for relief. Rubio v. Capital One Bank, 613 F.3d 15 1195, 1203 (9th Cir. 2010) (internal quotation marks and citations omitted). Plaintiff asserts 16 Defendants’ conduct violates the “unlawful” and “unfair” prongs. (Dkt. No. 1 at 44–45.) 17 Defendants respond that Plaintiff lacks standing to assert a UCL claim, or alternatively, that the 18 claim fails on the merits. (Dkt. Nos. 37 at 29–30, 43 at 28–29.) The Court disagrees. 19 To have standing to assert a UCL claim, a plaintiff needs to have “suffered injury in fact 20 and . . . lost money or property as a result of the unfair competition.” Rubio, 613 F.3d at 1203 . 21 “To show that they have lost money or property, Plaintiff[] must demonstrate some form of [22] 19 Defendants further argue Plaintiff’s unjust enrichment claim fails because she has not pled an [23] inadequate remedy at law. (See Dkt. Nos. 37 at 31, 43 at 28.) The Court rejects this argument in 24 light of “clearly established circuit practice allowing plaintiffs to plead in the alternative at the earliest stages of litigation.” Haas v. Travelex Ins. Servs. Inc., 555 F. Supp. 3d 970 , 980 (C.D. 25 Cal. 2021 ); see also Cabrales v. Castle & Cooke Mortg., LLC, 2015 WL 3731552 , slip op. at 3 (E.D. Cal. 2015) (collecting cases and noting the “ampl[e] support[]” for this proposition in the [26] Ninth Circuit). 1 economic injury, which is itself a classic form of injury in fact.” Brown v. Google LLC, 2021 2 WL 6064009 , slip op. at 15 (N.D. Cal. 2021) (citing Kwikset Corp. v. Superior Court, 246 P.3d 3 877, 886 (Cal. 2011)) (internal quotations omitted). Thus, because federal standing “may be 4 predicated on a broader range of injuries,” the effect of the “lost money or property” requirement 5 is to “render[] standing under [the UCL] substantially narrower than federal standing.” Id. 6 Here, Plaintiff asserts she has “suffered an injury in fact, including lost consideration for 7 provision of access to [her private data] and diminished value of that data.” (Dkt. No. 1 at 45.) 8 “[S]everal courts have held that the unauthorized release of ‘personal information’ does not 9 constitute a loss of money or property for purposes of establishing standing under the UCL.” 10 Fraley v. Facebook, Inc., 830 F. Supp. 2d 785, 811 (N.D. Cal. 2011) (collecting cases). 11 However, “the growing trend across courts . . . is to recognize the lost property value of this 12 information.” In re Marriott Int’l, Inc., Cust. Data Sec. Breach Litig., 440 F. Supp. 3d 447 , 461 13 (D. Md. 2020); see also Brown, 2021 WL 6064009 , slip op. at 15 (plaintiffs had UCL standing 14 where they alleged the “cash value” of the data which Google collected “can be quantified” and 15 “there is an active market for such data”); Calhoun v. Google LLC, 526 F. Supp. 3d 605 , 636 16 (N.D. Cal. 2021) (“[T]he Ninth Circuit and a number of district courts . . . have concluded that 17 plaintiffs who suffered a loss of their personal information suffered economic injury and had 18 standing.”). Like in Brown, Plaintiff cites several studies and reports showing an active market 19 for users’ private data. (See Dkt. No. 1 at 23–28.) Given this allegation, as well as the increasing 20 recognition of the value of private data, the Court concludes Plaintiff has asserted an injury in 21 fact and a loss of money or property sufficient to state a UCL claim. See Klein v. Facebook, Inc., [22] 580 F. Supp. 3d 743 , 803 (N.D. Cal. 2022) (“[N]umerous courts have recognized that plaintiffs 23 who lose personal information have suffered an economic injury.”) (collecting cases).20 [24] 20 Qualtrics and Microsoft further argue that because Plaintiff’s UCL claim rests on statutory 25 claims that fail, the “unlawful” UCL claim also fails. (Dkt. Nos. 37 at 29, 43 at 29.) But since Plaintiff has successfully stated claims under CIPA and the California Constitution, see supra [26] Part II.D(1)–(2), Defendants’ argument fails. 1 Accordingly, Defendants’ motions to dismiss Plaintiff’s UCL claim are DENIED. 2 3. Statutory Larceny 3 Three elements are required to show a violation of California Penal Code § 496(a): that 4 “(i) property was stolen or obtained in a manner constituting theft, (ii) [that] the defendant knew 5 the property was so stolen or obtained, and (iii) [that] the defendant received or had possession 6 of the stolen property.” Switzer v. Wood, 247 Cal. Rptr. 3d 114, 121 (2019), as modified (May 7 10, 2019); see also Cal. Penal Code § 496 (c) (authorizing a civil action for treble damages, costs, 8 and fees for those injured by a violation of subdivision (a)). California Penal Code § 484(a), in 9 turn, provides that a person is guilty of theft if they “feloniously steal, take, carry, lead, or drive 10 away the personal property of another,” or obtain property “by any false or fraudulent 11 representation or pretense.” Qualtrics and Microsoft argue, among other things, that Plaintiff 12 fails to show the first element: that Defendants stole or obtained Plaintiff’s property in a manner 13 constituting theft. (Dkt. Nos. 37 at 30, 43 at 30.) The Court agrees. 14 In her response, Plaintiff asserts Defendants obtained her data through misrepresentation 15 (i.e., in a manner constituting theft under § 496(a)). (Dkt. No. 55 at 30.) Specifically, she points 16 to the Kaiser Privacy Statement and states that it “misrepresents that third parties will not be able 17 to identify individuals by their data,” and that “she lacked notice of the collection of her personal 18 information.” (Id.) But the complaint lacks any allegation of misrepresentation. (See generally 19 Dkt. No. 1.) Moreover, the Kaiser Privacy Statement is a representation made by Kaiser, not by 20 Qualtrics or Microsoft. Accordingly, it cannot serve as the basis for a statutory larceny claim 21 against Qualtrics or Microsoft. 22 For those reasons, the Court DISMISSES Plaintiff’s statutory larceny claim. 23 4. Conversion 24 California law defines conversion as “any act of dominion wrongfully asserted over 25 another’s personal property in denial of or inconsistent with his rights therein.” In re Bailey, 197 26 F.3d 997, 1000 (9th Cir. 1999). To establish conversion, a plaintiff must show “ownership or 1 right to possession of property, wrongful disposition of the property right and damages.” Kremen 2 v. Cohen, 337 F.3d 1024, 1029 (9th Cir. 2003). Courts apply a three-part test to determine 3 whether a property right exists for these purposes: “First, there must be an interest capable of 4 precise definition; second, it must be capable of exclusive possession or control; and third, the 5 putative owner must have established a legitimate claim to exclusivity.” Id. at 1030 . Here, 6 Plaintiff fails to assert that her interest in the collected data is capable of exclusive possession or 7 control. See Taylor v. Google LLC, 2021 WL 4503459 , slip op. at 7 (N.D. Cal. 2021) (dismissing 8 conversion claim where plaintiffs fail to allege “facts demonstrating that their cellular data 9 allowances are ‘personal property’ capable of exclusive possession or control”). 10 Accordingly, the Court DISMISSES Plaintiff’s conversion claim. 11 5. Punitive Damages 12 Finally, Microsoft asks the Court to dismiss Plaintiff’s request for punitive damages 13 because Plaintiff fails to allege facts showing “Microsoft is guilty of ‘oppression, fraud, or 14 malice,’ or “evil motive’ against her,” as is required to obtain punitive damages under California 15 law. (Dkt. No. 43 at 31) (citing Grieves v. Sup. Court, 203 Cal. Rptr. 556, 560 (1984); Scott v. 16 Phoenix Schools, Inc., 96 Cal. Rptr. 3d 159, 170 (2009)). In response, Plaintiff contends that a 17 “request for punitive damages is not a ‘claim’ and is not the proper subject of a motion to dismiss 18 under Fed. R. Civ. P. 12(b)(6).” (Dkt. No. 55 at 31) (quoting Shimy v. Wright Med. Tech., Inc., [19] 2014 WL 3694140 , slip op. at 4 (C.D. Cal. 2014)). But as Microsoft correctly notes, numerous 20 courts have found a motion to dismiss to be the proper vehicle for removing punitive damages 21 from a complaint. (Dkt. No. 56 at 17) (citing Panoyan v. Regalo Int’l LLC, 2019 WL 8758897 , 22 slip op. at 3–4 (C.D. Cal. 2019); Agape Family Worship Center, Inc. v. Gridiron, 2016 WL 23 633864, slip op. at 6 (C.D. Cal. 2016)). Furthermore, the Court agrees that Plaintiff fails to allege 24 any facts showing Microsoft is guilty of oppression, fraud, or malice. (See generally Dkt. No. 1.) 25 Therefore, the Court DISMISSES Plaintiff’s request for punitive damages without prejudice and 26 with leave to amend. 1 III. CONCLUSION 2 For the foregoing reasons, the Court GRANTS in part and DENIES in part Defendants’ 3 motions to dismiss (Dkt. Nos. 37, 43) and GRANTS in part and DENIES in part Qualtrics’ 4 motion for judicial notice (Dkt. No. 38). Specifically, the following claims are dismissed with 5 prejudice:21 6 • Plaintiff’s CFAA claim against both Defendants; and 7 • Plaintiff’s statutory larceny claim against both Defendants. 8 The following claims are dismissed without prejudice:22 9 • Plaintiff’s CIPA § 631(a) claim against both Defendants (but only to the extent she 10 bases her claim on intentional wiretapping); 11 • Plaintiff’s CIPA § 632 claim against Microsoft; and 12 • Plaintiff’s conversion claim against both Defendants. 13 All remaining claims survive. 14 DATED this 19th day of December 2023. A [17] John C. Coughenour 18 UNITED STATES DISTRICT JUDGE [23] 24 21 Given the deficiencies described above, the Court finds that further amendment would not 25 save these claims. See Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). 22 If Plaintiff seeks leave to amend the pleading deficiencies described above for these claims, [26] she shall so move pursuant to Rule 15.