King v. Hard Rock Cafe Int'l (USA), Inc.

[7] 8 UNITED STATES DISTRICT COURT 9 FOR THE EASTERN DISTRICT OF CALIFORNIA [10] 11 CHRISTINA KING, No. 2:24-cv-01119-DC-CKD 12 Plaintiff, 13 v. ORDER GRANTING DEFENDANT’S MOTION TO DISMISS PLAINTIFF’S FIRST 14 HARD ROCK CAFE INTERNATIONAL AMENDED COMPLAINT (USA), INC., 15 (Doc. No. 18) Defendant. [16] 17 This matter is before the court on Defendant’s motion to dismiss Plaintiff’s first amended 18 class action complaint. (Doc. No. 18.) Pursuant to Local Rule 230(g), the pending motion was 19 taken under submission to be decided on the papers. (Doc. No. 26.) For the reasons explained 20 below, the court will grant Defendant’s motion to dismiss. 21 BACKGROUND 22 On March 4, 2024, Plaintiff Christina King filed a complaint initiating this class action 23 against Defendant Hard Rock Cafe International (USA), Inc. for allegedly aiding Meta Platforms, 24 Inc. (“Meta”), formerly known as Facebook,1 in intercepting her sensitive and confidential 25 communications via a hidden tracking tool known as Meta Pixel (“Pixel”), that was installed on [26] 27 1 Plaintiffs refer to Meta as both “Meta” and “Facebook” throughout their complaint. For clarity in this order, the court uses “Meta” to refer to the corporation and “Facebook” to refer only to 28 Meta’s social media platform. 1 Defendant’s website at hardrockhotel[destination].com (“Website”). (Doc. No. 1-3 at 3.) 2 Defendant filed a motion to dismiss that original complaint, which the court denied as moot 3 because Plaintiff timely filed a first amended complaint as a matter of course pursuant to Federal 4 Rule of Civil Procedure 15(a)(1). (Doc. Nos. 10, 15.) 5 That is, on May 20, 2024, Plaintiff filed the operative first amended class action complaint 6 (“FAC”), bringing two claims against Defendant: (1) violation of the California Invasion of 7 Privacy Act (“CIPA”), California Penal Code § 631(a); and (2) violation of CIPA, California 8 Penal Code § 632. (Doc. No. 14 at 30–35.) Plaintiff brings these claims on behalf of herself and a 9 putative class consisting of “all California residents who have a Facebook account and accessed 10 and navigated the Website while in California.” (Id. at 28.) 11 Plaintiff alleges the following facts in her FAC. 12 Defendant is a Florida corporation that operates several hotels throughout the state of 13 California. (Id. at ¶ 4.) Defendant embedded Pixel, a “piece of code” that “tracks [] people and the 14 types of actions they take,” on its Website. (Id. ¶¶ 30, 42.) Pixel is one of many business tools 15 developed by Meta to “help website owners and publishers . . . integrate with Meta, understand 16 and measure their products and services, and better reach and serve people who might be 17 interested in their products and services.” (Id. at ¶ 27.) Pixel functions by tracking events on the 18 Website, such as when a user visits a webpage or clicks on a button to browse offerings. (Id. at ¶¶ 19 29–32). When an event occurs, Pixel causes the Website user’s browser “to secretly and 20 simultaneously duplicate the communication with Defendant[], transmitting it to [Meta’s] servers 21 alongside additional information that transcribe the communication’s content and the individual’s 22 identity.” (Id. at ¶ 31.) 23 The data intercepted by Meta via Pixel consists of “‘guest records’ identifying Website 24 users as [Defendant’s] guests, boarders, occupants, lodgers, customers, or invitees (i.e., name, 25 address, telephone number, credit card number, email address, ZIP code, and user-specific values 26 contained in [Meta] cookies).” (Id. at ¶ 44.) Meta also intercepts “Website users’ button clicks 27 selecting the destination to which they wish to travel, the desired dates for their trip, the number 28 of rooms they require, the numbers of adults and children who will be traveling, and the particular 1 hotel section or tower in which they wish to stay.” (Id. at ¶ 116.) In addition, Meta “intercepts the 2 URL of webpages visited by Website users,” allowing Meta “to track Website users’ actions or 3 conversions funneling them from one portion of the Website to another.” (Id.) The information 4 intercepted by Meta is not anonymized because Meta “collects users’ email addresses” and 5 “Defendant enables [Meta] to link users’ communications with [the Website to] their Facebook 6 IDs, which reveal their identities.” (Id. at ¶ 72.) 7 Plaintiff is a resident of Sacramento, California. (Id. at ¶ 3.) In or around 2010, Plaintiff 8 created a Facebook account. (Id.) Plaintiff visited Defendant’s Website “[s]everal times, 9 including on or around March 29, 2023 and June 6, 2023,” using the same web browser she used 10 to access her Facebook account. (Id.) On the Website, Plaintiff “browsed and booked a Hard 11 Rock hotel.” (Id.) Plaintiff alleges each of her communications, including confidential “guest 12 records,” was intercepted by Meta, enabled by Defendant. (Id.) Plaintiff did not consent to Meta’s 13 interception of her communications with Defendant’s Website. (Id.) 14 On July 3, 2024, Defendant filed the pending motion to dismiss Plaintiff’s claims pursuant 15 to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be 16 granted. (Doc. No. 18.) On August 5, 2024, Plaintiff filed an opposition to the pending motion. 17 (Doc. No. 23.) On August 19, 2024, Defendant filed its reply thereto. (Doc. No. 24.) On October 18 10, 2024, Plaintiff filed a notice of supplemental authority in support of her opposition to 19 Defendant’s motion to dismiss. (Doc. No. 27.) 20 LEGAL STANDARD 21 A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) is a challenge to 22 the sufficiency of the allegations set forth in the complaint. Navarro v. Block, 250 F.3d 729 , 732 23 (9th Cir. 2001). “Dismissal under Rule 12(b)(6) is proper when the complaint either (1) lacks a 24 cognizable legal theory or (2) fails to allege sufficient facts to support a cognizable legal theory.” 25 Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). In determining whether a complaint 26 states a claim upon which relief can be granted, the court accepts as true the allegations in the 27 complaint and construes the allegations in the light most favorable to the plaintiff. Manzarek v. St. 28 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the court is not 1 required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact, 2 or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). 3 Under Federal Rule of Civil Procedure Rule 8(a), a complaint must include “a short and 4 plain statement of the claim showing that the pleader is entitled to relief,” in order to “give the 5 defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp. 6 v. Twombly, 550 U.S. 544, 570 (2007). A complaint must allege enough facts to state a claim to 7 relief that is plausible on its face. Id. at 570 . “A claim has facial plausibility when the plaintiff 8 pleads factual content that allows the court to draw the reasonable inference that the defendant is 9 liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “The plausibility 10 standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility 11 that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556 ). If a claim is 12 dismissed for failure to comply with these requirements, “[l]eave to amend should be granted 13 unless the district court ‘determines that the pleading could not possibly be cured by the 14 allegation of other facts.’” Knappenberger v. City of Phoenix, 566 F.3d 936, 942 (9th Cir. 2009) 15 (quoting Lopez v. Smith, 203 F.3d 1122 , 1127 (9th Cir. 2000)). 16 ANALYSIS 17 Defendant contends that Plaintiff’s complaint should be dismissed in its entirety because 18 Plaintiff fails to state a claim under Section 631(a) and Section 632 of CIPA.2 (Doc. No. 18.) The 19 court addresses each argument in turn. 20 A. California Invasion of Privacy Act: Section 631(a) 21 The CIPA “broadly prohibits the interception of wire communications and disclosure of 22 the contents of such intercepted communications.” Tavernetti v. Superior Ct. of San Diego Cnty., [23] 22 Cal. 3d 187 (1978). Section 631(a) of CIPA creates four avenues for relief: 24 (1) where a person “by means of any machine, instrument, or 25 2 Defendant also argues Plaintiff’s CIPA claims fail because she expressly consented to Defendant’s terms and policies that allowed Meta to obtain her information. (Doc. No. 18-1 at [26] 20–25.) Because the court finds Plaintiff has failed to state a claim under Sections 631 and 632, 27 the court does not address Defendant’s arguments regarding consent. Accordingly, the court will deny as moot Defendant’s request for judicial notice of relevant terms and conditions. (Doc. No. 28 18-15.) 1 contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection . . . with any telegraph or telephone wire, 2 line, cable, or instrument”; 3 (2) where a person “willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to 4 read, or to learn the contents or meaning of any message, report, or communication while the same is in transit”; [5] (3) where a person “uses, or attempts to use, in any manner, or for 6 any purpose, or to communicate in any way, any information so obtained”; and [7] (4) where a person “aids, agrees with, employs, or conspires with any 8 person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above.” [9] Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891 , 897 (N.D. Cal. 2023). Plaintiff invokes the [10] fourth avenue of relief, alleging Defendant has violated Section 631(a) of the CIPA by “enabling [11] [Meta’s] wrongdoing.” (Doc. Nos. 14 at ¶¶ 105, 107; 23 at 10.) [12] Defendant contends that Plaintiff’s Section 631(a) claim should be dismissed because [13] Plaintiff (1) fails to allege Meta “read or attempted” to read the “contents” of Plaintiff’s [14] communications that were allegedly intercepted and (2) fails to allege facts showing that [15] Defendant “aided” or “conspired” with Meta. (Doc. No. 18-1 at 12–16.) Because the court finds [16] dismissal of Plaintiff’s Section 631(a) claim is warranted due to her failure to allege the [17] “contents” of her communications, the court need not and will not address Defendant’s remaining [18] argument. [19] A violation of CIPA is analyzed under the same standards applied to a violation of the [20] federal wiretap act, Electronic Communications Privacy Act (“ECPA”), 18 U.S.C § 2510 et seq.; [21] Hammerling v. Google LLC, 615 F. Supp. 3d 1069 , 1092 (N.D. Cal. 2022). The ECPA defines [22] the term “contents” as “any information concerning the substance, purport, or meaning of that [23] communication.” 18 U.S.C. § 2510 . “Contents” means “the intended message conveyed by the [24] communication” as opposed to “record information regarding the characteristics of the message [25] that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098 , [26] 1106 (9th Cir. 2014); Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073 , 1083 (C.D. Cal. 2021) [27] (noting that Section 631(a) “protects only the internal, user-generated material of a message, not [28] 1 routine identifiers, whether automatically generated or not”). “Courts employ a contextual ‘case2 specific’ analysis hinging on ‘how much information would be revealed’ by the information’s 3 tracking and disclosure.” Hammerling, 615 F. Supp. 3d at 1092. While a URL that includes 4 “basic identification and address information” is not “content,” a website “user’s request to a 5 search engine for specific information could constitute a communication such that divulging a 6 URL containing that search term to a third party could amount to disclosure of the contents of a 7 communication.” Id. at 1108–09. 8 In its motion, Defendant argues the information Plaintiff alleges that Defendant enabled 9 Meta to obtain constitutes only “record information,” not the “contents” of any communication. 10 (Doc. No. 18-1 at 14.) In Defendant’s view, Plaintiff alleges Meta intercepted only the following 11 information: “her name, email, address, phone number, and room-selection information.” (Id.) 12 Defendant further argues that the URLs Plaintiff alleges were intercepted contain “room-related 13 selections and other (record) information” as opposed to the “intended message conveyed by the 14 communication.” (Id. at 13–14.) 15 In her opposition to the pending motion, Plaintiff argues that she has pled the “contents” 16 of her communications were intercepted because she alleges Meta received information regarding 17 her “button clicks.” (Doc. No. 23 at 13.) Specifically, Plaintiff alleges “button clicks” convey “the 18 destination to which [Website users] wish to travel, the desired dates for their trip, the number of 19 rooms they require, the number of adults and children who will be traveling, and the particular 20 hotel section or tower in which they wish to stay. (Doc. No. 14 at ¶ 20.) Plaintiff further argues 21 Defendant intercepted “full-string URLs of the Website pages she visited,” which convey 22 “individualized search terms and booking information.” (Doc. No. 23 at 7, 13.) 23 As an initial matter, the court notes that Plaintiff’s FAC does not identify with specificity 24 what information she provided on Defendant’s Website that was intercepted by Meta. Plaintiff’s 25 FAC dedicates only one short paragraph to describing her personal interactions with Defendant’s 26 Website. (Doc. No. 14 at ¶ 3.) Plaintiff alleges that she used Defendant’s Website “[s]everal 27 times” to “browse[] and book a Hard Rock hotel” (id.), but she does not describe her browsing 28 activity, such as what webpages she viewed, what buttons she clicked, what search terms she 1 used, what destinations she searched for, or what her desired dates of travel were. Nor does 2 Plaintiff describe the hotels she allegedly booked. Instead, Plaintiff’s FAC vaguely alleges that 3 her communications with Defendant’s Website included “guest records” that were intercepted by 4 Meta, as enabled by Defendant. See, e.g., Cousin v. Sharp Healthcare, 681 F. Supp. 3d 1117 , 5 1123 (S.D. Cal. 2023) (finding the plaintiffs’ complaint lacked sufficient factual support for a 6 CIPA claim because it only provided hypothetical examples and failed to specify what 7 information plaintiffs provided defendants through their browsing history). 8 In any event, Plaintiff’s FAC falls short of alleging that the “contents” of communications, 9 as opposed to “record information,” were intercepted. To the extent Plaintiff alleges Meta 10 intercepted “guest records” including the address, telephone number, email address, or zip code 11 of Website users, those allegations are insufficient because that information constitutes “record 12 information.” (Doc. No. 14 at ¶¶ 44, 68, 115); see Hammerling, 615 F. Supp. 3d at 1092–93 13 (“Generally, customer information such as a person’s name, address, and subscriber number or 14 identity is record information, but it may be contents when it is part of the substance of the 15 message conveyed to the recipient.”); In re Zynga Priv. Litig., 750 F.3d at 1106 (holding that 16 “contents” under CIPA does not include customer record information such as name or address). 17 Likewise, “button clicks” are “more akin to the ‘record’ information that the Ninth Circuit has 18 held not to be contents of a communication.” Mikulsky v. Bloomingdale’s, LLC, 713 F. Supp. 3d 19 833, 845 (S.D. Cal. 2024) (citing In re Zynga Priv. Litig., 750 F.3d at 1106 ); see also Yoon v. 20 Lululemon USA, Inc., 549 F. Supp. 3d 1073 , 1082–83 (C.D. Cal. 2021) (explaining that “mouse 21 clicks” do not constitute “message content in the same way that the words of a text message or an 22 email do” for purposes of CIPA). Finally, although “descriptive URLs that reveal specific 23 information about a user’s queries” may reflect the “contents” of communications under CIPA, 24 St. Aubin v. Carbon Health Techs., Inc., No. 4:24-cv-00667-JST, 2024 WL 4369675 , at *4 (N.D. 25 Cal. Oct. 1, 2024), as discussed above, Plaintiff’s FAC is devoid of any allegation describing her 26 search queries, if any. Notably, Plaintiff’s FAC provides examples of the types of “full-string 27 URLs” allegedly intercepted by Meta, but Plaintiff does not allege she conducted the searches or 28 visited the webpages provided in the examples. (Doc. No. 14 at ¶¶ 47–52.) Thus, Plaintiff has not 1 alleged that the “contents” of her communications were intercepted. 2 Therefore, the court will grant Defendant’s motion to dismiss Plaintiff’s claim brought 3 under Section 631(a) of CIPA. Because alleging additional facts could cure this pleading 4 deficiency, the court will grant Plaintiff leave to amend this claim. 5 B. California Invasion of Privacy Act: Section 632 6 Section 632 of CIPA imposes liability against a “person who, intentionally and without 7 the consent of all parties to a confidential communication, uses an electronic amplifying or 8 recording device to eavesdrop upon or record the confidential communication, whether the 9 communication is carried on among the parties in the presence of one another or by means of a 10 telegraph, telephone, or other device, except a radio.” Cal. Penal Code § 632 (a). The CIPA 11 defines a “confidential communication” as “any communication carried on in circumstances as 12 may reasonably indicate that any party to the communication desires it to be confined to the 13 parties thereto, but excludes a communication made . . . in any other circumstance in which the 14 parties to the communication may reasonably expect that the communication may be overheard or 15 recorded.” Cal. Penal Code § 632 (c). 16 “Courts generally find that internet communications do not have an objectively reasonable 17 expectation of confidentiality, especially if those communications can be easily shared by the 18 recipients of the communications.” Yoon v. Meta Platforms, Inc., No. 5:24-cv-02612-NC, 2024 19 WL 5264041 , at *6 (N.D. Cal. Dec. 30, 2024) (citing Brown v. Google LLC, 685 F. Supp. 3d 909 , 20 938 (N.D. Cal. 2023)). A plaintiff must plead “something unique about [] particular internet 21 communications” to demonstrate those communications are confidential. In re Meta Pixel 22 Healthcare Litig., 647 F. Supp. 3d 778 , 799 (N.D. Cal. 2022) (finding that communications made 23 in the context of a patient-medical provider relationship were considered distinguishable from 24 typical online communications because they are protected by federal law and are uniquely 25 personal). 26 In its motion, Defendant argues Plaintiff has failed to allege that her communications were 27 “confidential” for purposes of a Section 632 claim. (Doc. No. 18-1 at 17.) Specifically, Defendant 28 argues that Plaintiff has not alleged facts “sufficient to overcome any presumption that the 1 information in her ‘internet-based’ communications” with Defendant’s Website are not 2 confidential. (Id.) Defendant contends Plaintiff has not plausibly alleged that she had a reasonable 3 expectation of privacy that booking information such as her “name, email address, phone number, 4 and/or room-related selections” would not be shared. (Id. at 18.) In her opposition, Plaintiff 5 counters that her communications were “confidential” and she “reasonably expected that her 6 communications would be confined” to her and Defendant because California Civil Code Section 7 53.5(a) mandates that “guest records” are confidential. (Doc. No. 23 at 16) (citing Cal. Civ. Code 8 § 53.5(a)). In response, Defendant argues California Civil Code Section 53.5(a) permits the 9 sharing of information by business entities with third parties for business-related purposes, and 10 there is no authority for the proposition that a “guest record” as defined by California Civil Code 11 Section 53.5(a) is per se confidential under Section 632 of CIPA. (Doc. Nos. 18-1 at 17–19, 24 at 12 10.) 13 Regardless of whether “guest records” under California Civil Code Section 53.5(a) qualify 14 as “confidential” communications under Section 632 of CIPA, Plaintiff has not alleged that her 15 communications with Defendant’s Website constitute guest records. As discussed above, because 16 the extent of Plaintiff’s allegations are that she used Defendant’s Website “[s]everal times” to 17 “browse[] and book a Hard Rock hotel,” (Doc. No. 14 at ¶ 3), Plaintiff’s FAC lacks sufficient 18 factual information regarding her interactions with Defendant’s Website, as required to state a 19 cognizable Section 632 claim. In light of Plaintiff’s bare allegations regarding her interactions 20 with Defendant’s Website, a reasonable inference cannot be drawn that Plaintiff had a reasonable 21 expectation of privacy in the communications Meta intercepted. Thus, Plaintiff has not pled that 22 her communications were “confidential” as required for a claim under Section 632. 23 Therefore, the court will grant Defendant’s motion to dismiss Plaintiff’s claim under 24 Section 632 of CIPA. Because alleging additional facts could cure this pleading deficiency, the 25 court will grant Plaintiff leave to amend this claim as well. 26 CONCLUSION 27 For the reasons explained above: 28 1. Defendant’s request for judicial notice (Doc. No. 18-15) is DENIED; 1 2. Defendant’s motion to dismiss (Doc. No. 18) is GRANTED, with leave to amend; 2 3. Within twenty-one (21) days of the date of entry of this order, Plaintiff shall file a 3 second amended complaint, or alternatively, file a notice of her intent not to file a 4 second amended complaint; and 5 4. Plaintiff is warned that her failure to comply with this order may result in an order 6 dismissing this case. [7] IT IS SO ORDERED. □ 9 | Dated: _ June 9, 2025 LY Os Dena Coggins 10 United States District Judge