Jackson v. LinkedIn Corporation

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA [6] 7 JACQUELINE JACKSON, Case No. 5:24-cv-00812-PCP 8 Plaintiff, ORDER GRANTING MOTION TO 9 v. DISMISS 10 LINKEDIN CORPORATION, Re: Dkt. No. 60 Defendant. [11] 12 Plaintiff Jacqueline Jackson brings this putative class action against defendant LinkedIn 13 Corporation, alleging that LinkedIn used its Insight Tag to unlawfully obtain and use personal 14 information from LinkedIn users visiting the California Department of Motor Vehicles website. 15 LinkedIn moves to dismiss Jackson’s claim under the federal Drivers’ Privacy Protection Act 16 (DPPA) for failure to state a claim, and argues that, if the Court dismisses that claim, it should 17 decline to exercise supplemental jurisdiction over her state law claims. For the following reasons, 18 the Court grants LinkedIn’s motion to dismiss the DPPA claim with prejudice and orders the 19 parties to show cause why Jackson’s state law claims should or should not be dismissed without 20 prejudice in the absence of any remaining federal question. 21 BACKGROUND 22 Jackson is a California resident who has been a registered LinkedIn user for at least 10 23 years.1 Jackson has an online account with the DMV, called a “MyDMV” account. Jackson 24 submitted personal information, including her name, phone number, and email address, to the 25 DMV in order to create her MyDMV account. [27] 1 Jackson has had a disability parking placard issued by the DMV since approximately 2009. 2 In 2023, Jackson used her mobile phone to renew her placard through the DMV’s website, which 3 required that she provide her first and last name, date of birth, disability information, and email 4 address. She was signed into her MyDMV account throughout the process of renewing her 5 placard. She alleges that in January 2024, she discovered that LinkedIn was using its Insight Tag 6 to obtain her personal information from her MyDMV account and to learn the contents of her 7 communications with the DMV in connection with her placard renewal. 8 LinkedIn’s Insight Tag is used to gather information across websites to support marketing 9 services that LinkedIn offers to its customers, including targeted advertising. Customers like the 10 DMV can install the Insight Tag on their own webpages to track a user’s actions on their website. 11 Jackson alleges that personal information and private communications are transmitted to LinkedIn, 12 incorporated into the user’s LinkedIn profile, and employed for targeted advertising. Jackson 13 alleges that LinkedIn used the information it received from the DMV “to generate substantial 14 revenue from advertising and marketing services.” 15 In her original complaint, Jackson alleged that LinkedIn’s conduct violates the DPPA and 16 the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 630 . LinkedIn moved to dismiss 17 the case, arguing under Rule 12(b)(7) that the complaint failed to join the DMV as a necessary 18 party and under Rule 12(b)(6) that Jackson failed to state a valid claim. On August 13, 2024, the 19 Court granted LinkedIn’s motion to dismiss in part. The Court denied the 12(b)(7) motion and 20 denied the 12(b)(6) motion as to the CIPA claim but granted it as to the DPPA claim. The Court 21 concluded that Jackson had failed to plausibly allege that the personal information LinkedIn 22 purportedly obtained through the Insight Tag came from a motor vehicle record. 23 On September 3, 2024, Jackson filed a first amended complaint asserting the same claims. 24 LEGAL STANDARD 25 Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain 26 statement of the claim showing that the pleader is entitled to relief.” If the complaint does not do 27 so, the defendant may move to dismiss the complaint under Federal Rule of Civil Procedure 1 reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 2 U.S. 662 , 678 (2009). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint 3 lacks a cognizable legal theory or sufficient facts to support a cognizable legal 4 theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To 5 survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief 6 that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). 7 In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the 8 complaint as true and construe the pleadings in the light most favorable” to the non-moving 9 party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028 , 1029–30 (9th Cir. 2009). While legal 10 conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct 11 unless adequately “supported by factual allegations.” Iqbal, 556 U.S. at 679. Courts do not “accept 12 as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable 13 inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell 14 v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). 15 ANALYSIS 16 I. Jackson fails to state a claim under the DPPA. 17 To establish a potential violation of the DPPA, a plaintiff must plausibly allege that the 18 defendant: (1) knowingly took some affirmative action to obtain, disclose, or use personal 19 information (2) from a motor vehicle record (3) for an impermissible purpose. 18 U.S.C. § 2721 ; 20 Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1259 (9th Cir. 2019). Personal information is 21 information that “identifies an individual, including an individual’s photograph, social security 22 number, driver identification number, name, address (but not the 5-digit zip code), telephone 23 number, and medical or disability information.” 18 U.S.C. § 2725 (3). A motor vehicle record is a 24 record maintained by the DMV pertaining to a driver’s operating permit, title, registration, or 25 identification card. 18 U.S.C. § 2725 (1). 26 Accordingly, in order to state a DPPA claim, Jackson must allege that the information 27 transmitted to LinkedIn via the Insight Tag was personal information, as defined by 18 U.S.C. § 1 Insight Tag transmitted personal information to LinkedIn, she does not allege facts sufficient to 2 show that the information came from a motor vehicle record. 3 A. Personal information 4 Much of the information that the Insight Tag purportedly transmits from the California 5 DMV website to LinkedIn is not personal information within the meaning of 18 U.S.C. § 2725 (3). 6 Jackson alleges the Insight Tag transmits URLs, the fact that a particular button has been clicked, 7 and browser cookies that match website user interactions with LinkedIn members. Most URLs and 8 buttons do not contain personal information, which is defined as information that identifies an 9 individual. Jackson alleges, for example, that when a MyDMV user changes their phone number, 10 the Insight Tag transmits to LinkedIn the fact that a “Change Phone Number” button has been 11 clicked and that the user has visited the URL “https://www.dmv.ca.gov/portal/update-your-phone12 number/.” Neither of those pieces of information is personal information because neither identifies 13 the user. 14 Nevertheless, some of the information that the Insight Tag allegedly transmits does fall 15 within the definition of personal information under 18 U.S.C. § 2725 (3). Jackson alleges that 16 when she renewed her disability parking placard, the Insight Tag transmitted the full text of a URL 17 revealing that she was going through the placard renewal process (thus disclosing her disability). 18 Disability information is expressly defined as personal information under 18 U.S.C. § 2725 (3). 19 Likewise, Jackson alleges that the Insight Tag transmitted her email address to LinkedIn, and 20 “email addresses fall within the ordinary meaning of information that identifies an individual 21 because they can prove or establish the identity of an individual and … often expressly include the 22 account holder’s name, affiliated organization, or other identifying information.” Gershzon v. 23 Meta Platforms, Inc., No. 23-CV-00083-SI, 2023 WL 5420234 at *5 (N.D. Cal. Aug. 22, 2023) 24 (cleaned up) (quoting United States v. Hastie, 854 F.3d 1298, 1303 (11th Cir. 2017)). 25 Accordingly, Jackson has adequately alleged that the Insight Tag transmitted her personal 26 information to LinkedIn. 27 B. From a motor vehicle record 1 LinkedIn via the Insight Tag, she has not adequately alleged that this personal information came 2 from a motor vehicle record. Nearly all of the personal information that Jackson alleges was 3 transmitted to LinkedIn came from Jackson herself, and, as the Court held in its prior order 4 granting in part LinkedIn’s motion to dismiss, information that Jackson herself entered into the 5 DMV’s website is not a motor vehicle record. While the personal information that was purportedly 6 transmitted may have been identical to information contained in a motor vehicle record, it did not 7 come from that motor vehicle record. “[W]here, as here, the initial source of personal information 8 is a record in the possession of an individual, rather than a state DMV, then use or disclosure of 9 that information does not violate the DPPA.” Andrews, 932 F.3d at 1260 . 10 Andrews is illustrative. In that case, Sirius XM Radio obtained the plaintiff’s name and 11 address from a car dealer, who obtained that information from the plaintiff’s driver’s license. The 12 Court held that a driver’s license is not a motor vehicle record within the meaning of the DPPA 13 because “though issued by the DMV, [it] becomes the possession of an individual, not the DMV 14 that issued it.” Id. The Court concluded that obtaining information that is also contained in a motor 15 vehicle record from an independent source does not violate the DPPA. As the court explained, 16 construing the scope of the DPPA as limited to information taken directly from a motor vehicle 17 record is consistent with the statute’s purpose to prevent DMVs from releasing and selling drivers’ 18 personal information. Id. at 1259–61. 19 Jackson alleges that, in order to apply for a disability parking placard on the DMV website, 20 an individual must click a “Start Application” button, which takes them to a webpage containing 21 forms they must complete. She alleges that the URL of this webpage, which contains the text 22 “dpp-application-form,” is transmitted to LinkedIn by the Insight Tag. Jackson alleges that 23 “similar information” was transmitted when she renewed her placard. While the text “dpp24 application-form” indicates that an individual is seeking to obtain a disability parking placard, and 25 thus constitutes disability information (which is personal information under 18 U.S.C. § 2725 (3)), 26 the URL allegedly transmitted when Jackson renewed her placard came from Jackson’s 27 interactions with the DMV website, not a DMV motor vehicle record. 1 confirmation email from the DMV containing a “status checker” button. When an applicant clicks 2 that button, they are allegedly prompted to enter their email address and case number.2 They are 3 then allegedly redirected to a DMV webpage, and a URL containing their email address is 4 transmitted to LinkedIn. Once again, however, the email address in that URL is generated through 5 the applicant’s interactions with the webpage and the information they enter themselves. Just as 6 Andrews held that obtaining personal information from a driver’s license that was also stored in 7 the DMV’s records did not constitute obtaining information from a motor vehicle record, 8 obtaining information that Jackson herself entered on the DMV website does not constitute 9 obtaining information from a motor vehicle record, whether or not that information also “exist[s] 10 in the DMV’s database,” as Jackson puts it. 11 The only personal information allegedly transmitted via the Insight Tag that came from the 12 DMV itself rather than from Jackson and her interactions with the DMV website was her first 13 name, which appeared on a button on the DMV website after she created and logged into her 14 MyDMV account.3 Jackson alleges that after an individual creates a MyDMV account, the DMV 15 uses their first name, as listed in a DMV database, on the button used to access the MyDMV 16 portal. When a MyDMV user clicks that button, their first name is allegedly transmitted to 17 LinkedIn. [18] 19 2 Although Jackson alleges generally that placard applicants receive confirmation emails containing “status checker” buttons, she does not allege that she ever received such an email or 20 clicked the button. 3 LinkedIn argues that a first name is not personal information for purposes of the DPPA even [21] though the statute defines personal information to include a “name” and a first name is undoubtedly a “name.” While the Court need not resolve this question definitively given its [22] holding that Jackson has not alleged that LinkedIn received her first name from a motor vehicle record, the Court notes that multiple other courts have held that similarly nonspecific information, [23] such as height, weight, hair color, and eye color, falls within the definition of personal information under 18 U.S.C. § 2725 (3). See Gershzon, 2023 WL 5420234 , at *6; Dahlstrom v. Sun-Times [24] Media, LLC, 777 F.3d 937 (7th Cir. 2015). Medical and disability information are also expressly covered by the DPPA even though they are not particularly specific. As the court explained in [25] Gershzon, an expansive reading of “personal information” serves the public safety purpose of the DPPA because “although a potential stalker would likely require information beyond hair and eye [26] color to positively identify his victims, details regarding any pertinent physical feature would make such identification easier.” 2023 WL 5420234 , at *6; see also United States v. Hastie, 854 27 F.3d 1298, 1304 (11th Cir. 2017) (“The term ‘personal information’ should be read naturally to 1 This Court previously explained that information on a public-facing DMV website cannot 2 be a motor vehicle record because a record consists of “information about an individual that is 3 maintained by an agency,” but it noted that a MyDMV account is at least arguably maintained by 4 an agency for the purposes of the DPPA. But while maintenance by an agency is a necessary 5 condition for any DPPA claim, it is not sufficient because not all information maintained by an 6 agency falls within the definition of motor vehicle record. For the purposes of the DPPA, motor 7 vehicle records include only records pertaining to a driver’s operating permit, title, registration, or 8 identification card. 18 U.S.C. § 2725 (1). 9 It is certainly possible that records within a user’s MyDMV account might fall within this 10 definition.4 Jackson, however, has not adequately alleged that her first name, as maintained by the 11 DMV in connection with her MyDMV account, specifically pertains to a driver’s operating 12 permit, title, registration, or identification card. To the contrary, Jackson alleges that she provided 13 her first name to the DMV in order to establish that account and access the MyDMV portal. 14 Notably, any internet user with an email address and phone number can create a MyDMV account, 15 whether or not they ever intend to apply for an operating permit, title, registration, or identification 16 card.5 Jackson’s first name as displayed on the button on the DMV website came from a record 17 maintained by the DMV for the purposes of allowing website access, not in relation to any license, 18 placard, or vehicle title it issued to her. 19 Jackson notes that the DMV “advises individuals to ‘use the name that will appear on your 20 driver’s license or identification card’” when they create their MyDMV account. As a result, the 21 first name on the button associated with their account is likely to be the same as the first name on [23] 4 If the MyDMV portal displayed information taken directly from the DMV’s database of licensed [24] drivers or vehicle titles, for example, that information might be obtained “from a motor vehicle record” for DPPA purposes. [25] 5 The Court takes judicial notice of the existence and contents of the California DMV website and 26 the MyDMV registration process. See Am. Fed’n of Tchrs. v. DeVos, 484 F. Supp. 3d 731 , 739 (N.D. Cal. 2020); Fed. R. Evid. 201 (permitting judicial notice of “a fact that is not subject to 27 reasonable dispute” because the fact is “generally known” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned”). 1 their driver’s license or identification card. But, as explained above, information that is merely the 2 same as information contained within a motor vehicle record is not information that comes from a 3 motor vehicle record for DPPA purposes. 4 The DPPA applies only where a defendant has obtained personal information from a motor 5 vehicle record, and Jackson again fails to allege that any personal information transmitted to 6 LinkedIn via the Insight Tag—whether from her MyDMV account or otherwise—was obtained 7 from such a record. Accordingly, the Court grants LinkedIn’s motion to dismiss Jackson’s 8 amended DPPA claim. Because Jackson has already had an opportunity to amend her complaint to 9 address this deficiency but has failed to do so, the Court’s dismissal of that claim is with prejudice 10 and without leave to amend. 11 II. The parties are ordered to show cause why the Court has or does not have CAFA jurisdiction over Jackson’s CIPA claim. [12] 13 LinkedIn argues that, if Jackson’s federal claim is dismissed, the Court should decline to 14 exercise supplemental jurisdiction over her remaining state law claim under the California 15 Invasion of Privacy Act. Jackson, however, contends both that the Court should exercise its 16 supplemental jurisdiction notwithstanding the absence of a federal claim and that this Court has 17 jurisdiction over her CIPA claim under the Class Action Fairness Act (CAFA), 28 U.S.C. § 18 1332(d)(2). 19 There is no question that this Court initially had federal question jurisdiction over this 20 lawsuit under 28 U.S.C. § 1331 because Jackson was pursuing a claim under a federal statute. 21 Without the DPPA claim, only her state law CIPA claim remains. The Court nonetheless retains 22 supplemental jurisdiction over her state law claim under 28 U.S.C. § 1367 (a) because the “state 23 and federal claims … derive from a common nucleus of operative fact.” See Gibbs, 383 U.S. at 24 725. Whether to exercise that jurisdiction is a discretionary matter. Satey v. JPMorgan Chase & 25 Co., 521 F.3d 1087, 1091 (9th Cir. 2008); 28 U.S.C. § 1367 (c)(3) (“The district courts may 26 decline to exercise supplemental jurisdiction over a claim … if … the district court has dismissed 27 all claims over which it has original jurisdiction.”). 1 stage of the litigation, the values of judicial economy, convenience, fairness, and comity.’” Lenk v. 2 Monolithic Power Sys., Inc., 2017 WL 4586832 , at *2 (N.D. Cal. June 1, 2017) (quoting Gibbs, 3 383 U.S. at 726). The stage of the litigation is a central consideration in weighing these values. 4 “[J]udicial economy and convenience … weigh less heavily early in a case.” Gastelum v. TJX 5 Companies, Inc., No. 21-CV-06714-VKD, 2023 WL 2224432 , at *2 (N.D. Cal. Feb. 24, 2023). 6 “[A] district court should generally decline the exercise of supplemental jurisdiction and dismiss a 7 case without prejudice when ‘the federal-law claims have dropped out of the lawsuit in its early 8 stages and only state law claims remain.’” Lenk, 2017 WL 4586832 , at *2 (quoting Carnegie9 Mellon Univ. v. Cohill, 484 U.S. 343, 348 (1988)); see also Wren v. Sletten Constr. Co., 654 F.2d 10 529, 536 (9th Cir. 1981) (“When … all federal claims are dismissed before trial, the proper 11 exercise of discretion requires dismissal of the state claim.”). Here, the case remains in its early 12 stages. Although the parties have engaged in some discovery, the case has not proceeded past the 13 pleadings and it is still nearly two years away from trial.6 It would not be especially burdensome 14 for a state court to familiarize itself with the facts here. Thus, while judicial economy and 15 convenience slightly disfavor dismissal simply because these proceedings are already underway, 16 these two factors carry minimal weight. 17 Fairness considerations weigh neither in favor of nor against dismissal. Both Jackson and 18 LinkedIn are California residents equally able to litigate in state or federal court, and Jackson has 19 not identified any prejudice that would result from having to refile her claims in state court. 20 While fairness is neutral and judicial economy and convenience only very slightly favor 21 exercising supplemental jurisdiction, comity concerns strongly weigh against doing so. Declining 22 to exercise this Court’s supplemental jurisdiction would allow the California state courts to 23 interpret and apply state law and to resolve a novel state law claim involving a class likely 24 composed primarily of Californians. In defining the limits of this Court’s diversity jurisdiction, 25 Congress demonstrated its intent for such claims to be pursued in state rather than federal court in [27] 6 At the hearing on LinkedIn’s motion, LinkedIn suggested a willingness to allow the discovery 1 most instances, and this Court generally must respect that judgment. Because these comity 2 concerns strongly outweigh any of the other relevant factors, it would be inappropriate for this 3 Court to exercise supplemental jurisdiction over Jackson’s CIPA claim in the absence of some 4 other basis for jurisdiction. 5 Jackson contends that the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332 (d)(2), 6 provides that alternative basis. CAFA provides that district courts have diversity jurisdiction over 7 class actions where the class has at least 100 class members, at least one plaintiff is a citizen of a 8 different state from at least one defendant, and the amount in controversy is greater than 9 $5,000,000. In her amended complaint, Jackson specifically alleges that at least one class member 10 is a citizen of a state where LinkedIn is not a citizen, that the class includes more than 100 11 members, and that the amount in controversy exceeds $5,000,000. 12 Although Jackson has pleaded the existence of CAFA jurisdiction, the Court has serious 13 concerns that CAFA’s “home state” exception precludes this Court from exercising CAFA 14 jurisdiction over Jackson’s CIPA claim. The home state exception provides that “a district court 15 shall decline to exercise jurisdiction … over a class action in which … greater than two thirds of 16 the members of all proposed plaintiff classes in the aggregate are citizens of the State in which the 17 action was originally filed.” 28 U.S.C. § 1332 (d)(4). In this case, the putative class is defined as 18 LinkedIn members who applied for, renewed, or checked the status of a California disability 19 parking placard on the California DMV website. Under these circumstances, it seems likely that 20 the class is composed overwhelmingly of California citizens. Even if some putative class members 21 were never California citizens and some have the left the state and are no longer California 22 citizens, it seems unlikely that those individuals constitute over one third of the class. 23 Unfortunately, the existing evidentiary record is inadequate for the Court to make a final 24 determination as to whether the home state exception applies to Jackson’s CIPA claim. Because 25 this presents a threshold issue that should be resolved as early as possible in the litigation, the 26 Court orders the parties to file, within 21 days, supplemental briefs of no more than 10 pages, 27 along with any supporting evidence, addressing whether CAFA’s “home state” exception applies 1 CONCLUSION 2 For the foregoing reasons, the Court grants LinkedIn’s motion to dismiss Jackson’s DPPA 3 claim. That claim is dismissed with prejudice and without leave to amend. The parties shall file 4 || supplemental briefs and supporting evidence regarding CAFA’s home state exception within 21 5 days of this Order. [6] 7 IT IS SO ORDERED. 8 || Dated: January 3, 2025 Ay [10] P. Casey Fitts I United States District Judge [17] Z 18