Carbajal v. Home Depot Incorporated

1 WO [5] 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA [9] 10 Ivonne Carbajal, No. CV-24-00730-PHX-DGC 11 Plaintiff, ORDER 12 v. 13 Home Depot U.S.A., Inc.; and Validity, Inc., 14 Defendants. [16] 17 Plaintiff Ivonne Carbajal brings this class action against retailer Home Depot.1 18 Plaintiff alleges violations of Arizona’s Telephone, Utility and Communication Service 19 Records Act (the “TUCSRA”). Docs. 1, 4. Defendant has filed a motion to dismiss under 20 Federal Rule of Civil Procedure 12(b)(6), which is fully briefed. Doc. 20. Defendant 21 requests oral argument, but the Court concludes that oral argument will not aid its decision. 22 For reasons stated below, the Court will grant the motion. 23 I. Background. 24 The following factual allegations of the amended complaint are taken as true for 25 purposes of this motion. Defendant uses Everest, an email tracking platform, for 26 promotional emails Defendant sends to individuals on its subscriber list. Doc. 4 ¶¶ 1-2, [27] 1 Plaintiff voluntarily dismissed Defendant Validity, Inc., a software development [28] company that provides email marketing platforms to businesses. Doc. 18. 1 28-31, 44.2 Everest utilizes email tracking pixels that Plaintiff calls “spy pixels.” Id. 2 ¶¶ 1-2, 20. A tracking pixel is a transparent image, typically one pixel high and one pixel 3 wide, embedded in an email. Id. ¶¶ 21-24. When the recipient opens the email, the pixel 4 reports to the sender certain information about the recipient’s interaction with the email. 5 Id. ¶¶ 23-27. Retailers use tracking pixels to determine how recipients engage with the 6 content to better target recipients with future emails. Id. ¶¶ 2, 6, 19, 21, 32. 7 Plaintiff subscribed to Defendant’s marketing email list and opened promotional 8 emails she received from Defendant. Id. ¶¶ 1, 10-11. Each email contained a pixel that 9 reported information to Defendant when the email was opened, including when, where, 10 and for how long it was opened; the recipient’s email address, client type, and path data; 11 the device used to open the email; whether the email was forwarded or printed; and whether 12 any links in the email were clicked. Id. ¶¶ 1-2, 6, 12, 26-27, 39-44, 70. Plaintiff had no 13 knowledge that the emails contained tracking pixels, and Defendant never received 14 Plaintiff’s authorization to use such pixels or to collect the information the pixels obtained. 15 Id. ¶¶ 7, 13, 45-46. 16 The complaint asserts a single count for violation of the TUCSRA, A.R.S. § 4417 1376 et seq. Id. ¶¶ 66-74.3 The TUCSRA makes it unlawful for a person to “[k]nowingly 18 procure . . . a public utility record, a telephone record or communication service record of 19 any resident of [Arizona] without the authorization of the customer to whom the record 20 pertains or by fraudulent, deceptive or false means.” A.R.S. § 44-1376.01(A)(1). Plaintiff 21 focuses on the phrase “communication service record” and claims that each time she 22 opened a marketing email from Defendant the tracking pixel violated the TUCSRA by [24] 2 Citations are to numbered paragraphs in the documents or numbers attached to the 25 top of pages by the Court’s electronic filing system. 3 The complaint also alleges generally that Defendant invaded Plaintiff’s privacy [26] and intruded on her seclusion (id. ¶ 73), but does not set forth separate causes of action for these torts or address their elements. See In re Est. of Reynolds, 327 P.3d 213, 215 (Ariz. [27] Ct. App. 2014) (discussing the torts of invasion of privacy and intrusion upon seclusion) (citing cases and Restatement (Second) of Torts § 652A-D); Briggs v. Cnty. of Maricopa, [28] No. CV-18-02684-PHX-EJM, 2020 WL 3440288 , at *3 (D. Ariz. June 23, 2020) (same). 1 impermissibly procuring a “communication service record” related to Plaintiff. Doc. 4 2 ¶¶ 70-72.4 3 In arguing that the complaint fails to state a claim, Defendant asserts that none of 4 the information collected by the tracking pixels constitutes a “communication service 5 record” under the TUCSRA. Doc. 20 at 6-15. 6 II. Rule 12(b)(6) Standard. 7 Dismissal under Rule 12(b)(6) is appropriate when the complaint lacks a cognizable 8 legal theory or fails to allege facts sufficient to support its theory. Balistreri v. Pacifica 9 Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). A complaint that sets forth a cognizable 10 legal theory will survive a motion to dismiss if it contains “sufficient factual matter, 11 accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, [12] 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 13 A claim has facial plausibility when the plaintiff pleads “factual content that allows the 14 court to draw the reasonable inference that the defendant is liable for the misconduct 15 alleged.” Id. 16 III. Arizona’s Statutory Scheme For Protecting Communication Service Records. 17 Seven years before enactment of the TUCSRA, Arizona amended the 18 Eavesdropping and Communications Act, A.R.S § 13-3001 et seq., to allow prosecutors to 19 subpoena “communication service records” from “communication service providers” that 20 do business in Arizona or furnish communication services within the state. A.R.S. § 1321 3018(A)-(B); see 2000 Ariz. Legis. Serv. Ch. 189 (H.B. 2428) (Apr. 7, 2000). The Act 22 defined “communication service provider” as “any person who is engaged in providing a 23 service that allows its users to send or receive oral, wire or electronic communications or 24 computer services.” A.R.S. § 13-3001(3). The Act defined “communication service [25] 26 4 Plaintiff has also sued Lowe’s and The Gap for violating the TUCSRA with tracking pixels. See Carbajal v. Lowe’s Home Centers LLC, No. CV-24-01030-PHX-DLR [27] (D. Ariz. May 5, 2024); Carbajal v. Gap Inc., No. CV-24-01056-PHX-ROS (D. Ariz. May 7, 2024). Plaintiff voluntarily dismissed the complaint against Lowe’s on September 26, [28] 2024. Plaintiff and The Gap filed a notice of settlement on November 29, 2024. 1 record” with the same language the legislature later used in the TUCSRA, which is 2 discussed below. See A.R.S. § 13-3018(G). 3 In 2006, Arizona enacted the Telephone Records Act. See 2006 Ariz. Legis. Serv. 4 Ch. 260, § 1 (H.B. 2785); A.R.S. T. 44, Ch. 9, Art. 20 (“Article 20, Telephone Records, 5 consisting of §§ 44-1376, 44-1376.01 to 44-1376.05, was added by Laws 2006, Ch. 260, § 6 1 effective September 21, 2006”). This statute prohibited the practice known as 7 “pretexting,” where data brokers fraudulently gain access to telephone records by posing 8 as the customer. They then sell the customer’s records without consent. See Ariz. Sen. 9 Fact Sheet for H.B. 2785, 2006 Reg. Sess. H.B. 2785 (Apr. 25, 2006). The Telephone 10 Records Act made it unlawful for a person to “[k]nowingly procure . . . a telephone record 11 of any resident of [Arizona] without the authorization of the customer to whom the record 12 pertains or by fraudulent, deceptive or false means.” 2006 Ariz. Legis. Serv. Ch. 260 § 1 13 (H.B. 2785) (codified at A.R.S. § 44-1376.01(A)(1)). The Act defined “telephone record” 14 to mean information “[r]etained by a telephone company” about a customer, such as “the 15 time the call started and ended, the duration of the call, the time of day the call was made, 16 any charges applied and any information that indicates the location from which or to which 17 the call was made.” Id. (codified at § 44-1376(4)).5 18 In 2007, Arizona enacted the TUCSRA to expand the Telephone Records Act to 19 include public utility records and communication service records, protecting these 20 additional records from the practice of pretexting. See 2007 Ariz. Sess. Ch. 210, § 2 (H.B. 21 2726) (May 14, 2007); see also A.R.S. T. 44, Ch. 9, Art. 20 (“The heading of Article 20 22 was changed from ‘Telephone Records” to “Telephone, Utility and Communication 23 Service Records”, by Laws 2007, Ch. 210, § 1, eff. September 19, 2007.”); Ariz. Sen. Fact 24 Sheet for H.B. 2726, 2007 Reg. Sess. H.B. 2726 (Apr. 20, 2007) (defining “pretexting” as 25 “the practice of getting personal information under false pretenses” and stating that the 26 TUCSRA’s purpose is to “[p]rohibit[] the procurement and sale of public utility records [27] 5 A “telephone record” is defined in the TUCSRA with the same words. A.R.S. [28] § 44-1376(7). 1 and communication service records through unauthorized, fraudulent or deceptive 2 means”). The TUCSRA provides that “[a] person shall not . . . [k]nowingly procure . . . a 3 public utility record, a telephone record or communication service record of any resident 4 of [Arizona] without the authorization of the customer to whom the record pertains or by 5 fraudulent, deceptive or false means.” A.R.S. § 44-1376.01(A)(1) (emphasis added). 6 Using the words of the Eavesdropping and Communications Act, the TUCSRA 7 defines “communication service record” in terms of “subscriber information” of particular 8 types: 9 “Communication service record” includes subscriber information, including name, billing or installation address, length of service, payment method, [10] telephone number, electronic account identification and associated screen 11 names, toll bills or access logs, records of the path of an electronic communication between the point of origin and the point of delivery and the [12] nature of the communication service provided, such as caller identification, 13 automatic number identification, voice mail, electronic mail, paging or other service features. [14] 15 A.R.S. § 44-1376(1). Similarly, the TUCSRA defines “public utility record” to include 16 “customer information” such as “name, billing or installation address, length of service, 17 payment method or any other personal identifying information.” A.R.S. § 44-1376(4). 18 And its definition of “telephone record” covers records arising from “the relationship 19 between the telephone company and the customer.” A.R.S. § 44-1376(7). Thus, the clear 20 purpose of the TUCSRA is to protect the records that three kinds of entities – telephone 21 companies, public utilities, and communication service providers – collect about their 22 subscribers and customers. The TUCSRA requires these entities to “establish reasonable 23 procedures to protect against unauthorized or fraudulent disclosure of such records that 24 could result in substantial harm or inconvenience to any customer.” A.R.S. § 44-1376(B). 25 The TUCSRA also provides a civil cause of action to customers whose records are 26 unlawfully procured, see § 44-1376.04, and makes a violation of the statute a class 1 27 misdemeanor, see § 44-1376.05. [28] 1 IV. Discussion. 2 Plaintiff claims that Defendant’s tracking pixels collect “communication service 3 records” in violation of the TUCSRA. Docs. 4 ¶ 69, 23 at 10. Focusing on discrete 4 categories of information contained in the statutory definition of “communication service 5 record,” Plaintiff contends that Defendant procured her “name”; her “electronic account 6 identification” or “associated screen name”; “access logs” of the time and place the email 7 was opened; and “records of the path of an electronic communication between the point of 8 origin and the point of delivery” by tracking whether the email was forwarded. Doc. 23 at 9 10-12 (citing Doc. 4 ¶¶ 37-44, 65, 69, 70). Plaintiff provides dictionary definitions for 10 some terms in the definition, such as “access” and “log,” but she makes no attempt to define 11 the key phrase “communication service,” which modifies “record,” or to explain what role 12 that phrase plays in the TUCSRA. Docs. 23 at 11, 24 at 5-6. 13 If the Arizona legislature had intended the TUCSRA to apply to any record about 14 any communication as Plaintiff contends, it could have done so by using the word “record.” 15 Instead, it used the phrase “communication service record,” which it lifted verbatim from 16 the Eavesdropping and Communications Act, a statute that applies directly to 17 “communication service providers.” As already noted, the Act defines “communication 18 service provider” to mean “any person who is engaged in providing a service that allows 19 its users to send or receive oral, wire or electronic communications or computer services.” 20 A.R.S. § 13-3001(3). This definition covers businesses such as internet service providers 21 that deliver actual communication services to subscribers, rather than retailers engaged in 22 selling goods and services who communicate with customers by email. And contrary to 23 Plaintiff’s assertion (Doc. 23 at 12-14), the interpretation of the TUCSRA should comport 24 with the Eavesdropping and Communications Act. The statutes address related subjects 25 and the TUCSRA uses specific language from the Act. See Welch-Doden v. Roberts, 42 26 P.3d 1166, 1171 (Ariz. Ct. App. 2002) (“In construing statutes, we have a duty to interpret 27 them in a way that promotes consistency, harmony, and function.”); Stambaugh v. Killian, [28] 398 P.3d 574, 575 (Ariz. 2017) (“Words in statutes should be read in context in determining 1 their meaning. . . . In construing a specific provision, we look to the statute as a whole and 2 we may also consider statutes that are in pari materia – of the same subject or general 3 purpose – for guidance and to give effect to all of the provisions involved.”); SolarCity 4 Corp. v. Arizona Dep’t of Revenue, 413 P.3d 678, 681 (Ariz. 2018) (“The best indicator of 5 [legislative] intent is the statute’s plain language, which we read in context with other 6 statutes relating to the same subject or having the same general purpose.”); Nicaise v. 7 Sundaram, 432 P.3d 925, 927 (Ariz. 2019) (“We interpret statutory language in view of 8 the entire text, considering the context and related statutes on the same subject.”). 9 Plaintiff fails to address the fact that the definition of “communication service 10 record” in the TUCSRA applies only to “subscriber information.” A.R.S. § 44-1376(1) 11 (“‘Communication service record’ includes subscriber information, including . . .”) 12 (emphasis added).6 When she quotes this definition, Plaintiff highlights the word 13 “includes” that appears before “subscriber information,” as though the word means that the 14 definition encompasses more than the specifically enumerated kinds of subscriber 15 information that follow. Doc. 23 at 7. But Plaintiff never makes this argument directly, 16 and she points to no other general category of information included in the definition. 17 The definition’s focus on “subscriber” information comports with other portions of 18 the TUCSRA which refer to the “customer” of a public utility in the definition of “public 19 utility record,” see § 44-1376(4), and to “the relationship between the telephone company 20 and the customer” in its definition of “telephone record,” see § 44-1376(7). In other words, 21 the statute consistently protects subscribers and customers from the unauthorized 22 procurement of their records maintained by telephone companies, public utilities, and 23 communication service providers. See A.R.S. §§ 44-1376(A)-(B). [25] 6 The definition also includes specific types of subscriber information such as the [26] “billing or installation address, length of service, [and] payment method[.]” Id. And as further evidence that it applies to the records of communication service providers, it [27] specifically includes “the nature of the communication service provided, such as caller identification, automatic number identification, voice mail, electronic mail, paging or other [28] service features.” A.R.S. § 44-1376(1) (emphasis added). 1 To summarize, the overall statutory scheme and the statute’s specific language make 2 clear that “communication service record” does not simply refer to the discrete categories 3 of information listed in the definition (categories that could be said to have been captured 4 by the tracking pixels), but instead refers to records communication service providers 5 maintain about their subscribers. See Doc. 20 at 11-12. 6 The Arizona legislature could expand the TUCSRA to cover information gathered 7 by marketing emails and pixel technology, but it has not done so. And prior to the recent 8 class actions brought in federal courts, the TUCSRA had never been invoked in a civil case 9 of this nature. See Hartley v. Urb. Outfitters, Inc., No. CV 23-4891, 2024 WL 3445004 , 10 at *4 & n.54 (E.D. Pa. July 17, 2024) (same and collecting recently filed cases). Plaintiff 11 cites no case from Arizona or elsewhere supporting her novel and broad interpretation of 12 the TUCSRA. Until recently, the only cases addressing the statute arose in the criminal 13 context and involved the law enforcement exemption under A.R.S. § 44-1376.02. See State 14 v. Zuck, No. 2 CA-CR 2019-0130, 2021 WL 2103598 , at *3-4 (Ariz. Ct. App. May 25, 15 2021) (affirming denial of motion to suppress subscriber information under § 44-1376.02); 16 State v. Duran, No. 2 CA-CR 2016-0318, 2017 WL 6333916 , at *3 (Ariz. Ct. App. Dec. 17 11, 2017) (affirming denial of motion to suppress telephone records and rejecting the 18 defendant’s citation to § 44-1376.01). 19 The Court’s interpretation of the TUCSRA is consistent with a recent state court 20 case, D’Hedouville v. H&M Fashion USA, Inc., No. C20243386, at *3 (Ariz. Super. Ct. 21 Oct. 11, 2024). The plaintiff in that case, like Plaintiff here, claimed that the defendant 22 violated the TUCSRA by using tracking pixels in marketing emails to obtain an “access 23 log.” Doc. 25-1 at 2. In dismissing the claim, the Arizona superior court noted that the 24 legislative history of the TUCSRA supported a narrower reading of the statute: [25] [The] TUSCRA was first enacted in 2006 to respond to concerns that 26 additional security was needed to prevent unauthorized disclosure of information that was held by telecommunications carriers, not direct email 27 marketing. See H.B. 2785 Fact Sheet 47th Leg. 2d Reg. Sess. (Ariz. Apr. 24, 28 2006) (“Local, long distance and wireless telephone companies collect customer information, including the numbers called, the time of the calls and [1] particular services used . . . The FCC is currently investigating numerous 2 companies for allegedly illegally procuring phone records.’) This initial focus on telephone records was expanded to include ‘communication service [3] records’ and ‘public utility records.’ It again showed a concern that 4 confidential information regarding a subscriber to a communication service might be procured by fraudulent or deceptive means. The Arizona legislature [5] has not amended the statute since 2007, and no Arizona court has interpreted 6 ‘communication service record’ to include the information gleaned from a tracking pixel. [7] 8 Id. at 4. The state court rejected the plaintiff’s “expansive interpretation of the statute[,]” 9 concluding that the information at issue – “when and how an email was opened, how long 10 it was opened, what device was used, the associated IP address of the recipient, and whether 11 it was forwarded – is not a ‘communication service record’ or a type of ‘access log’ 12 protected by [the] TUSCRA.” Id. at 5; see also Morgan v. Twitter Inc., No. 2:22-CV13 00122-MKD, 2023 WL 8115775 , at *15 (E.D. Wash. Nov. 22, 2023) (dismissing claim for 14 procurement of a “telephone record” where the plaintiff’s telephone number was obtained 15 from the plaintiff himself and not a “telecommunications company”). 16 Plaintiff’s complaint does not state a claim under the TUCSRA. It does not allege 17 that Defendant procured records from Plaintiff’s communication service provider. See 18 Doc. 20 at 15-16. The conduct at issue – sending marketing emails and collecting 19 information through tracking pixels – simply is not covered by the TUCSRA.7 20 / / / 21 / / / 22 / / / [23] 24 7 The Court also finds unpersuasive Plaintiff’s assertion that Defendant procured records from an email service provider such as Gmail or Yahoo. Doc. 23 at 13-14. The [25] complaint contains no such allegations, and the tracking pixels obtained information from Plaintiff, not Gmail or Yahoo. See Hastings v. BAC Home Loans Servicing, No. CV 1226 0051-TUC-JGZ, 2012 WL 13019522 , at *3 (D. Ariz. June 15, 2012) (“[A] court may not consider contentions alleged for the first time in a response to a motion to dismiss.”) [27] (citation omitted). The Court need not address Defendant’s other arguments that Plaintiff has not pled facts showing Defendant knowingly collected her information without [28] authorization or that she is Defendant’s customer. Docs. 20 at 20-22, 24 at 13-15. 1 IT IS ORDERED: 2 1. Defendant’s motion to dismiss (Doc. 20) is granted. 3 2. The Clerk is directed to enter a separate judgment of dismissal and terminate 4) this action. 5 Dated this 16th day of December, 2024. [6] David G. Campbell 9 Senior United States District Judge