Cara Jones v. Google LLC

FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT CARA JONES, as parent and guardian of E.J., N.J., A.J., and L.J., minors; JUSTIN EFROS, as parent and No. 21-16281 guardian of J.A.E. and J.R.E., Minors; NICHOLE HUBBARD, as parent and D.C. No. 5:19-cvguardian of C.H., a minor; individually 07016-BLF and on behalf of all others similarly situated; RENEE GILMORE, as parent and guardian of M.W., a minor; ORDER AND JAY GOODWIN, as parent and AMENDED guardian of A.G., a minor; BOBBI OPINION DISHMAN, as parent and guardian of C.D., a minor; PAULA RIDENTI, as parent and guardian of R.A. and R.M.A., minors; C.H.; E.J.; N.J.; A.J.; L.J.; J.A.E.; J.R.E.; M.W.; A.G.; C.D., Plaintiffs-Appellants, v. GOOGLE LLC; YOUTUBE, LLC; MATTEL, INC.; DREAMWORKS ANIMATION LLC; HASBRO, INC.; HASBRO STUDIOS, LLC; THE CARTOON NETWORK, INC.; CARTOON NETWORK STUDIOS, INC.; POCKETWATCH, INC.; 2 JONES V. GOOGLE, LLC REMKA, INC.; RTR PRODUCTION, LLC; RFR ENTERTAINMENT, INC., Defendants-Appellees. Appeal from the United States District Court for the Northern District of California Beth Labson Freeman, District Judge, Presiding Argued and Submitted August 31, 2022 Seattle, Washington Filed December 28, 2022 Amended July 13, 2023 Before: Michael Daly Hawkins, M. Margaret McKeown, and Gabriel P. Sanchez, Circuit Judges. Order; Opinion by Judge McKeown JONES V. GOOGLE, LLC 3 SUMMARY * Preemption / Children’s Online Privacy Protection Act The panel filed (1) an order denying a petition for panel rehearing, denying a petition for rehearing en banc, and amending the opinion filed on December 28, 2022; and (2) an amended opinion reversing the district court’s dismissal, on preemption grounds, of a third amended complaint in an action brought by a class of children, appearing through their guardians ad litem, against Google LLC and others, alleging that Google used persistent identifiers to collect data and track their online behavior surreptitiously and without their consent in violation of the Children’s Online Privacy Protection Act (“COPPA”). Google owns YouTube, an online video-sharing platform that is popular among children. Google’s targeted advertising is aided by technology that delivers curated, customized advertising based on information about specific users. Google’s technology depends partly on what Federal Trade Commission (“FTC”) regulations call “persistent identifiers,” information “that can be used to recognize a user over time and across different Web sites or online services.” 16 C.F.R. § 312.2 . In 2013, the FTC adopted regulations under COPPA that barred the collection of children’s “persistent identifiers” without parental consent. The plaintiff class alleged that Google used persistent identifiers to collect data and track their online behavior * This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. 4 JONES V. GOOGLE, LLC surreptitiously and without their consent. They pleaded only state law causes of action, but also alleged that Google’s activities violated COPPA. The district court held that the “core allegations” in the third amended complaint were preempted by COPPA. The panel considered the question of whether COPPA preempts state law claims based on underlying conduct that also violates COPPA’s regulations. Express preemption is a question of statutory construction. COPPA’s preemption clause provides: “[n]o State or local government may impose any liability . . . that is inconsistent with the treatment of those activities or actions under this section.” 15 U.S.C. § 6502 (d). The panel held that state laws that supplement, or require the same thing, as federal law, do not stand as an obstacle to Congress’s objectives, and are not “inconsistent.” The panel was not persuaded that the insertion of “treatment” in the preemption clause evinced clear congressional intent to create an exclusive remedial scheme for enforcement of COPPA requirements. The panel concluded that COPPA’s preemption clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by, COPPA. Even if express preemption is not applicable, preemptive intent may be inferred through conflict preemption principles. The panel held that although express and conflict preemption are analytically distinct inquiries, they effectively collapse into one when the preemption clause uses the term “inconsistent.” For the same reasons that the panel concluded there was no express preemption, the panel concluded that conflict preemption does not bar the plaintiffs’ claims. JONES V. GOOGLE, LLC 5 COUNSEL David S. Golub (argued), Steven L. Bloch, and Ian W. Sloss, Silver Golub & Teitell LLP, Stamford, Connecticut; Jonathan K. Levine, Elizabeth C. Pritzker, and Caroline C. Corbitt, Pritzker Levine LLP, Emeryville, California; for Plaintiffs-Appellants. Edith Ramirez (argued), Adam Cooke (argued), Jessica L. Ellsworth, Michelle A. Kisloff, and Jo-Ann T. Sagar, Hogan Lovells US LLP, Washington, D.C.; Christopher Cox, Hogan Lovells US LLP, Menlo Park, California; Helen Y. Trac, Hogan Lovells LLP, San Francisco, California; Christopher Chorba and Jeremy S. Smith, Gibson Dunn & Crutcher LLP, Los Angeles, California; Anna Hsia, ZwillGen Law LLP, San Francisco, California; Jeffrey Landis and Adya Baker, ZwillGen Law PLLC, Washington, D.C.; Jonathan H. Blavin, Munger Tolles & Olson LLP, San Francisco, California; Jordan D. Segall and Ariel T. Teshuva, Munger Tolles & Olson LLP, Los Angeles, California; Michael J. Saltz and Elana R. Levine, Jacobson Russell Saltz Nassim & De La Torre LLP, Los Angeles, California; Jeremy S. Goldman, Frankfurt Kurnit Klein & Selz PC, Los Angeles, California; David E. Fink and Sarah E. Diamond, Venable LLP, Los Angeles, California; Angel A. Garganta, Venable LLP, San Francisco, California; for Defendants-Appellees. Tyler S. Badgley, U.S. Chamber Litigation Center, Washington, D.C.; Derek L. Shaffer, Quinn Emanuel Urquhart & Sullivan LLP, Washington, D.C.; for Amicus Curiae Chamber of Commerce of the United States of America. 6 JONES V. GOOGLE, LLC Mariel Goetz, Federal Trade Commission, Washington, D.C., for Amicus Curiae Federal Trade Commission. ORDER The opinion filed on December 28, 2022, and appearing at 56 F.4th 735 , is amended by the opinion filed concurrently with this order. The panel has voted to deny the petition for rehearing. Judge Sanchez has voted to deny the petition for rehearing en banc and Judges Hawkins and McKeown have so recommended. The full court has been advised of the petition for rehearing en banc and no judge has requested a vote on whether to rehear the matter en banc. Fed. R. App. P. 35. The petition, Dkt. No. 63, is DENIED. No further petitions will be entertained. OPINION McKEOWN, Circuit Judge: The Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501–06, gives the Federal Trade Commission (“FTC”) authority to regulate the online collection of personal identifying information about children under the age of 13. The statute includes a preemption clause that provides that “[no] State or local government may impose any liability . . . inconsistent with the treatment JONES V. GOOGLE, LLC 7 of those activities or actions under this section.” Id. § 6502(d). Hewing closely to the language of the preemption clause, we determine that Congress intended to preempt inconsistent state laws, not state laws that are consistent with COPPA’s substantive requirements, such as the state law causes of action pleaded in the complaint here. BACKGROUND Google, best known for its popular search engine, also owns YouTube, a widely used online video-sharing platform. YouTube videos are particularly popular among children, who increasingly have smartphones and tablets that allow them to access the platform without age verification. As a testament to YouTube’s popularity among kids, several popular toy and cartoon brands maintain YouTube “channels,” where they post content and run advertisements designed to appeal to young audiences. Google’s targeted advertising is aided by sophisticated technology that delivers curated, customized advertising based on information about specific users. Its tracking tools can keep tabs on users’ search history, video viewing history, personal contacts, browsing history, location information, and several other bits of information about users’ habits and preferences, including activity on websites and platforms not owned by Google. Together, these pieces of information comprise detailed individual “profiles” of users’ attributes and behaviors, extremely valuable tools for the advertisers who seek to capitalize on this deep trove of information about their targeted audiences. The revenue from these targeted ads is split between Google and the owners of the relevant YouTube channels; indeed, Google, whose search and video platforms are largely free to its users, makes most of its money through ad revenue. 8 JONES V. GOOGLE, LLC Google’s technology depends partly on what FTC regulations call “persistent identifiers,” information “that can be used to recognize a user over time and across different Web sites or online services.” 16 C.F.R. § 312.2 . Examples include users’ Internet Protocol addresses (“IP addresses”), numerical labels assigned to each device connected to the Internet. Google tracks users’ IP addresses on all webpages using Google’s advertising services. In 2013, the FTC adopted regulations under COPPA that barred the collection of children’s “persistent identifiers” without parental consent. 16 C.F.R. §§ 312.2 , 312.5. In this putative class action, plaintiffs are several minor children (collectively “the Children”) suing through guardians ad litem, alleging that Google used persistent identifiers to collect data and track their online behavior surreptitiously and without their consent. They seek damages and injunctive relief, asserting only state law claims: invasion of privacy, unjust enrichment, consumer protection violations, and unfair business practices, arising under the constitutional, statutory, and common law of California, Colorado, Indiana, Massachusetts, New Jersey, and Tennessee. The parties agree that all of the claims allege conduct that would violate COPPA’s requirement that childdirected online services give notice and obtain “verifiable parental consent” before collecting persistent identifiers. The complaint names two sets of defendants. First are Google LLC and YouTube, LLC, which together own and operate the YouTube platform (collectively “Google”). Second are numerous content creators that uploaded childdirected content to YouTube, including major toy brands and a television network that showcases cartoons (collectively the “Channel Owners”). Although the Children plead only state law causes of action, they also allege that Google’s data JONES V. GOOGLE, LLC 9 collection activities violated COPPA, and that Google falsely represented that COPPA’s requirements did not apply to YouTube, reasoning that it was a platform for adults, even while knowing that children use the platform. The complaint alleges that Google did not configure YouTube to comply with COPPA until January 2020, after reaching a settlement with the FTC and the New York Attorney General in the fall of 2019. As for the Channel Owners, the complaint alleges that they lured children to their channels, knowing that the children who viewed content on YouTube would be tracked, profiled, and targeted by Google for behavioral advertising. The district court dismissed the Second Amended Complaint, concluding that the Children’s claims were expressly preempted by COPPA, 15 U.S.C. § 6502 (d). The Children filed a Third Amended Complaint, adding additional details about the allegedly deceptive conduct. The court again held that the “core allegations” in that complaint were “squarely covered, and preempted, by COPPA.” Regarding the deceptive conduct amendments, the court held that the Children had again “failed to allege deception beyond what is regulated by COPPA.” The court granted the Children leave to file another amended complaint “if they can substitute proper plaintiffs to represent persons in the 13-16 age range”—i.e., older than COPPA’s cutoff at 13 years old. The Children informed the district court that they did not intend to further amend and filed this appeal instead. ANALYSIS Under COPPA and its regulations, companies that operate websites and online services marketed toward children must provide certain disclosures about their data 10 JONES V. GOOGLE, LLC collection activities and must safeguard the confidentiality, security, and integrity of the children’s personal online information. 15 U.S.C. § 6501–06; 16 C.F.R. §§ 312 .1–13. COPPA does not authorize a private right of action. Rather, the statute confers enforcement authority on the FTC, 15 U.S.C. § 6505 (a), and on state attorneys general, who must notify the FTC and cooperate with it to bring civil actions as parens patriae, id. § 6504(a). Several other specified agencies retain enforcement authority over the entities that they oversee. Id. § 6505(b). This appeal presents the question whether COPPA preempts state law claims based on underlying conduct that also violates COPPA’s regulations. Preemption derives from the Supremacy Clause, which “invalidates state laws that interfere with, or are contrary to federal law.” Hillsborough Cnty. v. Automated Med. Labs., Inc., 471 U.S. 707 , 712–13 (1985) (quotation and citation omitted). The Supreme Court has identified “three different types of preemption”—express, conflict, and field. Murphy v. NCAA, 138 S. Ct. 1461, 1480 (2018). The district court based its dismissal on express preemption; Google and the Channel Owners argue in the alternative that the claims are conflict-preempted. Field preemption was not argued by any party and so we do not reach that question here. We review de novo the district court’s dismissal of the complaint on preemption grounds. Metrophones Telecomms., Inc. v. Glob. Crossing Telecomms., Inc., 423 F.3d 1056 , 1063 (9th Cir. 2005), aff’d, 550 U.S. 45 (2007). I. Express Preemption The “clear statement” rule provides that “Congress may expressly preempt state law by enacting a clear statement to that effect.” In re Volkswagen “Clean Diesel” Mktg., Sales JONES V. GOOGLE, LLC 11 Pracs., & Prod. Liab. Litig., 959 F.3d 1201, 1211 (9th Cir. 2020), cert. denied sub nom. Volkswagen Grp. of Am. v. Env’t Prot. Comm’n, 142 S. Ct. 521 (2021). Express preemption is a question of statutory construction, requiring a court to look to the plain wording of the statute and surrounding statutory framework to determine whether Congress intended to preempt state law. Id.; Nat’l R.R. Passenger Corp. v. Su, 41 F.4th 1147 , 1152–53 (9th Cir. 2022). Of course, congressional purpose “is the ultimate touchstone in every pre-emption case,” Altria Grp. v. Good, 555 U.S. 70, 76 (2008) (quotation and citation omitted), but the plain wording of the express preemption clause “necessarily contains the best evidence of Congress’[s] preemptive intent,” Puerto Rico v. Franklin Calif. Tax-Free Tr., 579 U.S. 115, 125 (2016) (citation omitted). 1 COPPA’s preemption clause provides: No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section. 15 U.S.C. § 6502 (d) (emphasis added). Although the word “treatment” appears unique to COPPA’s preemption clause, we note the similarity between this provision and other preemption clauses barring “inconsistent” state laws. Our decisions in Metrophones, [1] We assume without deciding that the presumption against preemption does not apply. 12 JONES V. GOOGLE, LLC Ishikawa, and Beffa each involved clauses preempting state laws “inconsistent” with federal statutes or regulations. Metrophones, 423 F.3d at 1072 (statute preempted “State requirements that are inconsistent with the Commission’s regulations” (quoting 47 U.S.C. § 276 (c))); Ishikawa v. Delta Airlines, 343 F.3d 1129, 1132 (9th Cir.), amended on denial of reh’g, 350 F.3d 915 (9th Cir. 2003) (statute preempted any “law, regulation, standard, or order that is inconsistent with regulations prescribed under this chapter” (quoting 49 U.S.C. § 45106 (a))); Beffa v. Bank of the West, 152 F.3d 1174, 1177 (9th Cir. 1998) (statute preempted “any provision of the law of any State . . . inconsistent with this chapter” or such regulations (quoting 12 U.S.C. § 4007 (b))). In each of these cases, we have read the statutory term “inconsistent” in the preemption context to refer to contradictory state law requirements, or to requirements that stand as obstacles to federal objectives. We do not see that Congress’s use of the phrase—“inconsistent with the treatment of those activities or actions”—distinguishes this case by changing the scope of the preemption clause. In these prior cases, where state law was not inconsistent with the methods of regulating, or treatment of, activities under the federal statute, we found express preemption inapplicable. See Metrophones, 423 F.3d at 1073 (court must ask “whether state law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress” (quotations and citation omitted)); Beffa, 152 F.3d at 1177 (statute did not preempt state law negligence causes of action “that supplement, rather than contradict” federal regulations); Ishikawa, 343 F.3d at 1132 (“[W]e cannot see how the duty the state common law imposed . . . could be inconsistent with the federal guidelines, which require the same thing with more JONES V. GOOGLE, LLC 13 specificity.”). In each case, we held that the preemption clauses did not bar state tort or contract laws imposing obligations similar or identical to the substantive federal requirements. In short, state laws that “supplement,” 152 F.3d at 1177 , or “require the same thing,” 343 F.3d at 1132 , as federal law, do not “stand[] as an obstacle,” 423 F.3d at 1073, to Congress’s objectives, and so are not “inconsistent.” By contrast, Google’s construction would effectively read the word “inconsistent” out of COPPA’s preemption provision. Under Google’s reading, COPPA would preempt all state law claims protecting children’s online privacy. Such an interpretation ignores Congress’s distinction between “inconsistent” and “consistent” state laws and contravenes the command that courts “must give effect, if possible, to every clause and word of a statute.” Loughrin v. United States, 573 U.S. 351 , 358 (2014). Given this context, we are not persuaded that the insertion of “treatment” in the preemption clause here evinces clear congressional intent to create an exclusive remedial scheme for enforcement of COPPA requirements. Since the bar on “inconsistent” state laws implicitly preserves “consistent” state substantive laws, it would be nonsensical to assume Congress intended to simultaneously preclude all state remedies for violations of those laws. This assumption is particularly unpersuasive here where Congress has “legislated . . . in a field which the States have traditionally occupied,” Rice v. Santa Fe Elevator Corp., 331 U.S. 218, 230 (1947). If Congress intended to alter this longstanding state regulatory scheme, we would expect it to have done so explicitly. See Whitman v. Am. Trucking Ass’ns, 531 U.S. 457, 468 (2001) (“Congress . . . does not . . . hide elephants in mouseholes.”). It is logical to conclude 14 JONES V. GOOGLE, LLC that if exercising state-law remedies does not stand as an obstacle to COPPA in purpose or effect, then those remedies are treatments consistent with COPPA. Cf. Arellano v. Clark Cnty. Collection Serv., LLC, 875 F.3d 1213, 1218 (9th Cir. 2017) (holding the Federal Debt Collection Practices Act preempted state debt execution mechanisms because those mechanisms would enable debt collectors to “evade the restrictions of the Act” and thus “thwart enforcement of the [Act] and undermine its purpose”). Our reasoning comports with the long line of cases holding that a state law damages remedy for conduct already proscribed by federal regulations is not preempted. Cf. Bates v. Dow Agrosciences LLC, 544 U.S. 431, 448 (2005) (“To be sure, the threat of a damages remedy will give manufacturers an additional cause to comply, but the requirements imposed on them under state and federal law do not differ.”); Medtronic, Inc. v. Lohr, 518 U.S. 470, 495 (1996) (“Nothing in [21 U.S.C.] § 360k denies Florida the right to provide a traditional damages remedy for violations of common-law duties when those duties parallel federal requirements.”); Wigod v. Wells Fargo Bank, 673 F.3d 547, 581 (7th Cir. 2012) (“The absence of a private right of action from a federal statute provides no reason to dismiss a claim under a state law just because it refers to or incorporates some element of the federal law.”). Because the Federal Trade Commission is the principal enforcer of COPPA, we asked the agency for its views on preemption. In its amicus brief, the FTC wrote that “[t]he parties dispute only whether express or conflict preemption principles bar plaintiffs’ state law claims.” The panel concluded that neither form of preemption applies and, on this record, the FTC agrees. The FTC went on to note that “[t]he panel correctly determined that state law claims like JONES V. GOOGLE, LLC 15 those here, which are brought as fully stand-alone causes of action under state law . . . but involve conduct that also violates COPPA, are generally consistent with COPPA and not preempted. Congress did not intend to wholly foreclose state protection of children’s online privacy, and the panel properly rejected an interpretation of COPPA that would achieve that outcome.” And, the FTC concluded, “[t]he panel properly rejected Google’s interpretation, which would have the extreme effect of providing immunity from a wide swath of traditional state law claims that were never discussed in COPPA’s legislative history, much less swept aside altogether.” We hold that COPPA’s preemption clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by, COPPA. Express preemption therefore does not apply to the Children’s claims. II. Conflict Preemption Even if express preemption is not applicable, “[p]reemptive intent may also be inferred” through conflict preemption principles, Altria, 555 U.S. at 76–77, that is, “when state law conflicts with a federal statute,” Ass’n des Éleveurs de Canards et d’Oies du Québec v. Bonta, 33 F.4th 1107, 1114 (9th Cir. 2022). There are two types of conflict preemption: (1) “‘conflicts’ that prevent or frustrate the accomplishment of a federal objective,” and (2) “‘conflicts’ that make it impossible for private parties to comply with both state and federal law.” Geier v. Am. Honda Motor Co., 529 U.S. 861, 873 (2000). Only the first type, which turns on Congress’s “objective” in enacting COPPA, is at issue here. Although express and conflict preemption are analytically distinct inquiries, they effectively collapse into 16 JONES V. GOOGLE, LLC one when the preemption clause uses the term “inconsistent.” Metrophones, 423 F.3d at 1073. Under either approach, the question is “whether ‘state law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress’” or the regulatory agency with rulemaking authority. Id. (quoting Gade v. Nat’l Solid Wastes Mgmt. Ass’n, 505 U.S. 88, 98 (1992)). For the same reasons that we conclude there is no express preemption, we conclude that conflict preemption does not bar the Children’s claims. We reverse the district court’s dismissal of the third amended complaint on preemption grounds. We remand so that the district court can consider in the first instance the alternative arguments for dismissal, to the extent those arguments were properly preserved. REVERSED AND REMANDED.