Heeger v. Facebook, Inc.

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA [6] 7 BRETT HEEGER, Case No. 18-cv-06399-JD 8 Plaintiff, ORDER RE MOTION TO DISMISS v. [9] Re: Dkt. No. 26 10 FACEBOOK, INC., Defendant. [12] 13 This is a privacy class action lawsuit brought by plaintiff Brett Heeger against defendant 14 Facebook, Inc., on behalf of a putative class of Facebook users who turned off Facebook’s 15 “Location History” feature. Heeger alleges that Facebook continued to “track, log, and store” 16 their private location information “regardless of users’ choices” to deactivate that feature. Dkt. 17 No. 1 ¶¶ 1, 43. Facebook has moved to dismiss plaintiff’s complaint under Federal Rules of Civil 18 Procedure 12(b)(1) and 12(b)(6). Dkt. No. 26. The motion is granted and denied in part, with 19 leave to amend. 20 DISCUSSION 21 Facebook’s unopposed request for judicial notice, Dkt. Nos. 27, 32, is granted, and 22 plaintiff’s fifth claim under California’s Consumer Legal Remedies Act, Cal. Civ. Code § 1750 et 23 seq., is dismissed because plaintiff has abandoned that claim to “streamline the case.” Dkt. No. 33 24 at 15 n.12. That leaves four claims: (1) violation of the California Invasion of Privacy Act 25 (“CIPA”), Cal. Pen. Code § 630 et seq.; (2) violation of California’s constitutional right of 26 privacy; (3) intrusion upon seclusion; and (4) violation of the Stored Communications Act 27 (“SCA”), 18 U.S.C. § 2701 et seq. Dkt. No. 1 ¶¶ 52-86. 1 I. ARTICLE III STANDING 2 Facebook says that Heeger lacks Article III standing for all of the claims because he has 3 not alleged a concrete and specific injury in fact. Dkt. No. 26 at 6-9. Heeger originally filed this 4 lawsuit in federal court, and so he bears the burden of establishing Article III jurisdiction. Patel v. 5 Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019). “[G]eneral factual allegations of injury 6 resulting from the defendant’s conduct may suffice, and we presume that general allegations 7 embrace those specific facts that are necessary to support the claim.” Id. (quotations omitted). 8 The question is whether the intangible harm to privacy that Heeger alleges under federal 9 and state statutes is a concrete injury in fact for Article III purposes. Patel v. Facebook Inc., 290 10 F. Supp. 3d 948, 952 (N.D. Cal. 2018). To determine whether the violation of a statute creates a 11 concrete injury, the Court considers “(1) whether the statutory provisions at issue were established 12 to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, 13 (2) whether the specific procedural violations alleged in this case actually harm, or present a 14 material risk of harm to, such interests.” Patel, 932 F.3d at 1270 -71 (quoting Robins v. Spokeo, 15 Inc., 867 F.3d 1108, 1103 (9th Cir. 2017)). History and legislative judgments “play important 16 roles” in the analysis. Patel, 290 F. Supp. 3d at 952. “History is instructive because an intangible 17 harm is likely to be concrete for standing purposes when it bears ‘a close relationship to a harm 18 that has traditionally been regarded as providing a basis for a lawsuit.’” Id. The legislative 19 judgments of Congress and state legislatures are also “‘instructive and important’ to our standing 20 inquiry.” Patel, 932 F.3d at 1273 . 21 The complaint alleges that “Facebook systematically and covertly tracks, collects, and 22 stores users’ private location information even after users have affirmatively opted not to share 23 their location history,” Dkt. No. 1 ¶ 9, and that Facebook uses this information “to provide third 24 party companies with targeted advertising” for its own corporate profits. Id. ¶ 34. That is the 25 factual platform for the intrusion upon seclusion claim, and the violations of the California 26 Constitution, CIPA and SCA. 27 These allegations amply establish a concrete injury under Article III. To start with the 1 solitude, seclusion, and private affairs by continuing to track, build and store detailed location 2 histories without their knowledge and consent,” Dkt. No. 1 ¶ 71, and that Facebook exploited that 3 information for its own financial gain. Heeger also alleges a “reasonable expectation[] of privacy 4 in [his] mobile device[] and online behavior generally, including [his] physical locations.” Id. 5 ¶ 69. Such “[p]rivacy rights have long been regarded ‘as providing a basis for a lawsuit in English 6 or American courts.’” Patel, 932 F.3d at 1271 (quoting Spokeo, Inc. v. Robins, 136 S. Ct. 1540 , 7 1549 (2016)). “The Supreme Court has likewise recognized the common law roots of the right to 8 privacy,” and “[b]oth the common law and the literal understandings of privacy encompass the 9 individual’s control of information concerning his or her person.” Id. at 1272-73. Consequently, 10 Heeger has adequately alleged an actual and concrete invasion of his privacy rights that is 11 actionable in federal court under Article III. 12 So too for Heeger’s privacy claim under the California Constitution. The California 13 Supreme Court has stated that the “principal focus” for Article I, section 1 is “readily discernible,” 14 and the ballot argument for its passage warned “of unnecessary information gathering, use, and 15 dissemination by public and private entities.” Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1 , 16 21 (1994). “Informational privacy is the core value furthered by the Privacy Initiative,” and the 17 “California constitutional right of privacy ‘prevents government and business interests from 18 (1) collecting and stockpiling unnecessary information about us and from (2) misusing 19 information gathered for one purpose in order to serve other purposes or to embarrass us.’” Id. at 20 35. Heeger has alleged facts sufficient to state a concrete harm in light of these factors. 21 The injuries for the CIPA and SCA claims are also actual and concrete. “In enacting 22 [CIPA], the Legislature declared in broad terms its intent ‘to protect the right of privacy of the 23 people of this state’ from what it perceived as ‘a serious threat to the free exercise of personal 24 liberties [that] cannot be tolerated in a free and civilized society.’ (Pen. Code, § 630.) This 25 philosophy appears to lie at the heart of virtually all the decisions construing the Privacy Act.” 26 Ribas v. Clark, 38 Cal. 3d 355, 359 (1985). And for the Stored Communications Act, our circuit 27 has held that “[b]ecause the plaintiffs allege that Facebook and Zynga are violating statutes that 1 grant persons in the plaintiffs’ position the right to judicial relief, we conclude they have standing 2 to bring this claim.” In re Zynga Privacy Litigation, 750 F.3d 1098 , 1105 n.5 (9th Cir. 2014). 3 Consequently, there is no doubt that Heeger has the right to bring this case in federal court. 4 Facebook makes a last effort to avert this conclusion by saying that the SCA and CIPA “do[] not 5 apply” to plaintiff’s allegations. Dkt. No. 26 at 8. The point is not well taken. That is in effect a 6 merits argument, and the jurisdictional and merits inquiries are independent. Patel, 290 F. Supp. 7 3d at 952, 956 (“dispositive disputes on the merits should be decided on summary judgment or at 8 trial, and not in the Rule 12(b)(1) jurisdictional context”) (citing Safe Air for Everyone v. Meyer, [9] 373 F.3d 1035, 1039 (9th Cir. 2004)). The only issue in play at this stage of this case is whether 10 Heeger may sue in federal court. He can. Whether he will prevail is an entirely different question. 11 II. THE CIPA CLAIM 12 Although Heeger has a perfect right to be before the Court, the individual counts are not 13 sufficiently developed to go forward. For the CIPA claim, Heeger says that Facebook illegally 14 used an “electronic tracking device to determine the location or movement of a person” in 15 violation of California Penal Code § 637.7(a). Dkt. No. 1 ¶ 54. The problem with this proposition 16 is that the plain language of the CIPA does not accommodate technology like a mobile app on a 17 digital device, and plaintiff does not persuasively show otherwise. Section 637.7 became law in 18 the late 1990s, and was expressly directed to banning the use of an “electronic tracking device,” 19 which is defined by subsection (d) as “any device attached to a vehicle or other movable thing that 20 reveals its location or movement by the transmission of electronic signals.” This language 21 contemplates things like a freestanding GPS unit hidden on a car, but not a downloaded Facebook 22 app of the sort in dispute here. In effect, the fast pace of developments in digital technology has 23 rendered the CIPA a poor fit for the world we live in today, a problem that besets many privacy24 related statutes. It may be possible for Heeger to provide additional facts that might address this 25 issue, but the complaint’s current allegations do not sufficiently allege an “electronic tracking 26 device” for a CIPA claim. 27 III. THE SCA CLAIM 1 allege that the “contents” of a communication that were in electronic storage were divulged by 2 Facebook to third parties in violation of 18 U.S.C. § 2702 (a)(1). The word “contents” means 3 “information concerning the substance, purport, or meaning of [the] communication,” and does 4 not include “data that is incidental to the use of a communication device.” United States v. Reed, [5] 575 F.3d 900, 914-17 (9th Cir. 2009). “Congress intended the word ‘contents’ to mean a person’s 6 intended message to another (i.e., the ‘essential part’ of the communication, the ‘meaning 7 conveyed,’ and the ‘thing one intends to convey’),” and it does not include “record information 8 about a user’s communication,” as opposed to “the communication itself.” Zynga, 750 F.3d at 9 1106-07. Heeger’s allegations fall short because he alleges only that Facebook collected users’ 10 location “data,” and not the contents of communications, even assuming Facebook “divulged” that 11 data to third parties. [12] IV. THE INTRUSION UPON SECLUSION CLAIM AND THE PRIVACY CLAIM 13 UNDER CALIFORNIA CONSTITUTION ART. I, SEC. 1 14 Heeger has brought a combination of claims for intrusion upon seclusion and a violation of 15 Article I, section 1 of the California Constitution. Dkt. No. 1 ¶¶ 59-75. Strictly speaking, these 16 are distinct claims with different elements. When brought together on the same factual basis, as 17 Heeger has done, “it is appropriate to assess the two claims together and examine ‘the largely 18 parallel elements’ of these two claims which call on the Court to consider ‘(1) the nature of any 19 intrusion upon reasonable expectations of privacy, and (2) the offensiveness or seriousness of the 20 intrusion, including any justification and other relevant interests.’” McDonald v. Kiloo ApS, 385 21 F. Supp. 3d 1022 , 1031-37 (N.D. Cal. 2019) (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 22 272, 288 (2009)). 23 The context-specific nature of the inquiry has been emphasized repeatedly by the 24 California Supreme Court. In Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 31, 36 (1994), 25 the court stated that “privacy interests and accompanying legal standards are best viewed flexibly 26 and in context,” and “[t]he extent of a privacy interest is not independent of the circumstances.” A 27 “plaintiff’s expectation of privacy in a specific context must be objectively reasonable under the 1 the element of offensiveness, “California tort law provides no bright line” and “each case must be 2 taken on its facts.” Shulman v. Group W. Prods., Inc., 18 Cal. 4th 200, 237 (1998). See also 3 Hernandez, 47 Cal. 4th at 289 (“There are degrees and nuances to societal recognition of our 4 expectations of privacy.”). 5 As currently alleged, the complaint does not provide enough facts to undertake the context6 specific inquiry into the plausibility of the privacy expectation or the offensiveness of the 7 intrusion. For example, the complaint does not state the precision of the location data Facebook is 8 alleged to have collected after users turned off “Location History.” This is important because a 9 generalized location, such as one that locates a user no more precisely than within several city 10 blocks, may not implicate much in the way of privacy concerns. Highly specific location data, on 11 the other hand, that identifies a user’s pinpoint comings and goings would likely present 12 substantially greater concerns. 13 The complaint does not clearly say what level of location data Facebook is alleged to have 14 collected after the “Location History” feature was turned off. It says only that the granularity of 15 the data is controlled by “Location Services,” not “Location History,” and that when “Location 16 Services” is turned off, Facebook “may still understand your location using things like check-ins, 17 events, and information about your internet connection.” Dkt. No. 1 ¶¶ 22, 31; see also id. ¶ 26 18 (“Location-related information can be based on things like precise device location (if you’ve 19 allowed us to collect it), IP addresses, and information from your and others’ use of Facebook 20 Products (such as check-ins or events you attend).”). Heeger alleges only that Facebook collected 21 his “private” location data, id. ¶ 84, and on that bareboned and vague allegation, the Court cannot 22 say that he has plausibly pleaded a privacy claim. 23 To be sure, the potentially deceptive conduct Heeger alludes to -- Facebook’s use of 24 confusingly similar location feature names, whose functional differences are hard to understand, 25 and reliance on finely parsed disclosures as notice -- gives considerable pause. If the question at 26 hand were only whether a reasonable consumer would have been confused or misled in these 27 circumstances, the Court may well have found a plausible claim. That is because deceit can be a 1 privacy intrusion especially offensive.” McDonald, 385 F. Supp. 3d 1036 . The problem for 2 || Heeger is that pleading the “plus” factor alone is not enough to carry the day, and the complaint 3 says too little in the way of facts tied specifically to the core elements of the two privacy counts. 4 There are other pleading flaws. It is not clear that Heeger used the Facebook app during 5 || the relevant time period. He says that he “accessed his Facebook through a web browser on his 6 || smart phone and through web browsers on both laptop and desktop computers,” and that he “has 7 || not used the Facebook app since 2016.” Dkt. No. 1] 10. It is also unclear how often Facebook 8 || tracked users. Heeger says that “Facebook continued to track and store his private location 9 || information... even when [he] did not use the Facebook app or tag his location in posts.” Dkt. 10 || No. 1910. But he also suggests that location collection was limited to “every time [users] use[d] 11 Facebook.” Id. 29; see also id. | 5 (Facebook “tracks, collects, and stores information about 12 || where users have logged in and used Facebook”). 13 Overall, plaintiff's allegations fail to meet the requirement of a “short and plain statement” 14 || under Federal Rule of Civil Procedure Rule 8 or to plausibly state intrusion upon seclusion and 3 15 California constitutional privacy claims under Rules 8 and 12(b)(6). The claims are dismissed. a 16 CONCLUSION 3 17 Facebook’s motion to dismiss is denied under Rule 12(b)(1), but granted under Rules 8 and S 18 12(b)(6). Heeger may file an amended complaint by January 27, 2020, if he so chooses. Failure 19 to meet that deadline will result in dismissal with prejudice under Rule 41(b). 20 IT IS SO ORDERED. 21 Dated: December 27, 2019 [23] JAMES/#PONATO 24 United States District Judge