Katz-Lacabe v. Oracle America, Inc.

[6] 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA [9] MICHAEL KATZ-LACABE, et al., 10 Case No. 22-cv-04792-RS Plaintiffs, [11] v. ORDER GRANTING IN PART AND 12 DENYING IN PART MOTION TO ORACLE AMERICA, INC., DISMISS AND GRANTING IN PART 13 AND DENYING IN PART MOTION TO Defendant. FILE UNDER SEAL [15] I. INTRODUCTION [16] On April 6, 2023, Defendant Oracle America, Inc.’s (“Oracle”) motion to dismiss [17] Plaintiffs’ initial complaint was granted in part and denied in part. See Order Granting in Part and [18] Denying in Part Defendant’s Motion to Dismiss (“4/6 Order”). Now, in their First Amended Class [19] Action Complaint (“FAC”), two individual Plaintiffs bring this putative class action against [20] Oracle, alleging the company violates internet users’ right to privacy as that right is enshrined [21] under the California Constitution and various state and federal privacy statutes. Defendant moves [22] to dismiss many of Plaintiffs’ claims under Federal Rules of Civil Procedure 12(b)(6) for failure to [23] state a claim or to comply with Federal Rule of Civil Procedure 8. Plaintiffs also filed a motion to [24] seal portions of the Offline Access Request Response Reports (OARRRs). For the reasons that [25] follow, both the motion to dismiss and motion to seal are granted in part and denied in part. These [26] motions are suitable for disposition without oral argument, and the motion hearing set for October [27] 5, 2023, is vacated. See Civ. L.R. 7-1(b). 1 II. BACKGROUND1 2 Plaintiffs in this case are two named individuals—Michael Katz-Lacabe, a resident of San 3 Leandro, California, and Dr. Jennifer Golbeck, a resident of Sugarloaf Key, Florida—who purport 4 to represent six separate classes of individuals in a suit against Oracle. Despite taking precautions 5 to maintain privacy and prevent third-party collection of their data, Plaintiffs each received a 6 document from Oracle (an OARRR) indicating that Oracle had tracked, compiled, and analyzed 7 their web browsing and other activity, thereby creating an “electronic profile” of them. See Dkt. 54 8 at 2, 6. Further, Plaintiffs aver Oracle tracks their internet activity across numerous websites with 9 various technological tools, their location through partnership with the company PlaceIQ, and 10 their financial data, and then makes that information available to third parties without Plaintiffs’ 11 consent. 12 Plaintiffs explain that Oracle collects data using a number of tools, including: (1) cookies 13 (pieces of software code stored on web browsers that collect users’ data, like IP addresses); (2) the 14 javascript code “bk-coretag.js” (proprietary code which copies and sends to Oracle what 15 information users are requesting from a website server, such as a URL, date and time of visit, and 16 webpage keywords); (3) tracking pixels (code embedded into webpages that track information 17 whenever the webpage is opened); (4) device identification; (5) cross-device tracking; (6) AddThis 18 widgets; and (7) Datalogix (an information broker specializing in profiles built from brick and 19 mortar purchases). As in their initial complaint, Plaintiffs take issue with Oracle’s extensive data 20 brokering business. In so doing, Plaintiffs focus on two key features of Defendant’s data 21 management platform (BlueKai Data Management Platform): (1) the Oracle Data Marketplace, 22 allegedly one of the world’s largest commercial data exchanges; and (2) the Oracle ID Graph. 23 Plaintiffs aver Defendant’s business model proceeds as follows: first, Oracle collects as many [25] 1 The factual background of this case is based on the well-pled allegations in the First Amended 26 Class Action Complaint (“FAC”), which are taken as true for the purposes of this motion. This background is presented in greater detail in the 4/6 Order given the substantial factual overlap 27 between the original complaint and the FAC. 1 types of personal information from internet users as possible. Then, Oracle synchronizes that data 2 to create individual profiles, analyzes the data, and monetizes the data by selling it on its Data 3 Marketplace. Plaintiffs argue that neither Oracle’s privacy policies, nor the privacy policies of 4 third-party publishers, provide a basis to conclude that Plaintiffs consented to this data collection, 5 curation, and monetization. 6 In the 4/6 Order, Plaintiffs’ Unfair Competition Law (UCL), Federal Wiretap Act, unjust 7 enrichment, and intrusion upon seclusion (on behalf of national and international sub-classes) 8 claims were dismissed, while Plaintiffs’ invasion of privacy, intrusion upon seclusion (for the 9 California sub-class), California Invasion of Privacy Act (CIPA), and declaratory judgment and 10 equitable relief claims survived. Plaintiffs filed their FAC on May 22, 2023, bringing some new 11 claims, dropping their UCL claim, and adding factual averments in support of other claims. Oracle 12 moved to dismiss most, but not all, of Plaintiffs’ claims. Additionally, Plaintiffs filed a motion to 13 seal portions of the OARRRs on September 19, 2023, which Defendant opposes. 14 III. MOTION TO DISMISS 15 A. Legal Standard 16 A complaint must contain “a short and plain statement of the claim showing that the 17 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations” are not 18 required, a complaint must have sufficient factual allegations to state a claim that is “plausible on 19 its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 20 544, 555, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that 21 allows the court to draw the reasonable inference that the defendant is liable for the misconduct 22 alleged.” Id. (citing Twombly, 550 U.S. at 556 ). This standard asks for “more than a sheer 23 possibility that a defendant has acted unlawfully.” Id. The determination is a context-specific task 24 requiring the court “to draw on its judicial experience and common sense.” Id. at 679. 25 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the claims alleged in the 26 complaint. Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal 27 theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” See 1 Conservation Force v. Salazar, 646 F.3d 1240, 1242 (9th Cir. 2011) (internal quotation marks and 2 citation omitted). When evaluating such a motion, the court must accept all material allegations in 3 the complaint as true and construe them in the light most favorable to the non-moving party. In re 4 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). It must also “draw all 5 reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d 6 556, 561 (9th Cir. 1987). 7 B. Discussion 8 Plaintiffs claim to represent six different potential classes of plaintiffs: the United States 9 Class,2 the California Sub-Class,3 the California Invasion of Privacy Act (CIPA) Sub-Class,4 the 10 Florida Sub-Class,5 the Florida Security of Communications Act (FSCA) Sub-Class,6 and the 11 Electronic Communications Privacy Act (ECPA) Sub-Class.7 12 On behalf of these classes, the FAC alleges nine causes of action: (1) Invasion of Privacy 13 under the California Constitution (for the California Sub-Class); (2) Intrusion Upon Seclusion 14 under California Common Law (on behalf of the United States Class, or in the alternative, the 15 California Sub-Class); (3) Intrusion Upon Seclusion under Florida Common Law (in the [17] 2 “All natural persons located in the United States whose personal information, or data derived 18 from their personal information, was used to create a profile and made available for sale or use through Oracle’s ID Graph or Data Marketplace.” [19] 3 “All natural persons located in California whose personal information, or data derived from their 20 personal information, was used to create a profile and made available for sale or use through Oracle’s ID Graph or Data Marketplace.” [21] 4 “All members of the California Sub-Class whose contents of their electronic communications 22 were intercepted by the use of Oracle’s bk-coretag.js functionality.” 23 5 “All natural persons located in Florida whose personal information, or data derived from their personal information, was used to create a profile and made available for sale or use through 24 Oracle’s ID Graph or Data Marketplace.” 25 6 “All members of the Florida Sub-Class whose contents of their electronic communications were intercepted by the use of Oracle’s bk-coretag.js functionality.” [26] 7 “All members of the United States Sub-Class whose contents of their electronic communications 27 were intercepted by the use of Oracle’s bk-coretag.js functionality.” 1 alternative, for the Florida Sub-Class); (4) Violation of the California Invasion of Privacy Act (on 2 behalf of the CIPA Sub-Class); (5) Violation of the FSCA, under Fla. Stat. § 934.03 (for the FSCA 3 Sub-Class); (6) Violation of the Federal Wiretap Act, under 18 U.S.C. § 2510 (for the ECPA Sub4 Class); (7) Unjust Enrichment, under California Common Law (on behalf of the United States 5 Class, or in the alternative, the California Sub-Class); (8) Unjust Enrichment, under Florida 6 Common Law (in the alternative, for the Florida Sub-Class); and (9) Declaratory Judgment and 7 Injunctive Relief (on behalf of all classes). 8 Defendant moves to dismiss all claims—with the exception of Plaintiffs’ first and second 9 claims, to the extent the second claim is brought against the California Sub-Class—under Rule 10 12(b)(6). 11 1. Second Cause of Action: Intrusion Upon Seclusion 12 First, Oracle moves to dismiss Plaintiffs’ second cause of action to the extent Plaintiffs 13 attempt to assert a California state claim on behalf of a non-California resident (Golbeck) and a 14 class inclusive of non-California residents (the United States Class). The prior order found that 15 Plaintiffs failed to show why California law should be applied nationwide for its intrusion upon 16 seclusion claim. See 4/6 Order. Plaintiffs contend they have augmented that claim with averments 17 which justify applying California law to the nationwide class and that, to the extent Oracle 18 disputes those allegations, Oracle merely raises a factual dispute inappropriate for resolution at the 19 motion to dismiss stage. 20 Plaintiffs argue the “last acts” necessary to make Oracle liable on an intrusion upon 21 seclusion claim occurred in California because it was in California that Oracle compiled, analyzed, 22 and sold their data. Dkt. 67, at 19–20. Defendant persuasively points out, however, that Plaintiffs’ 23 own allegations identify the last act necessary for liability to attach to be Oracle’s interception of 24 Plaintiffs’ data. See Dkt. 70, at 2; FAC ¶ 145. Plaintiffs’ theory of liability for intrusion upon 25 seclusion would make Oracle liable when it intercepted Plaintiffs’ data, and Plaintiffs do not offer 26 any reason to doubt that this interception of data, for non-California residents, occurs in those 27 residents’ home States. See Mazza v. Am. Honda Motor Co., 666 F.3d 581, 593 (9th Cir. 2012) 1 (“California considers the ‘place of the wrong’ to be the state where the last event necessary to 2 make the actor liable occurred.”), overruled on other grounds by Olean Wholesale Grocery Coop. 3 v. Bumble Bee Foods LLC, 31 F.4th 651 (9th Cir. 2022). Since the last act at which liability 4 attaches—here, interception of Plaintiff Golbeck’s data—occurred in Florida, this factor weighs 5 against applying California law nationwide. See, e.g., Hayden v. Retail Equation, Inc., No. 20-cv6 1203, 2022 WL 18397355 , at *5 (C.D. Cal. Nov. 28, 2022) (finding California law inapplicable to 7 privacy claims where “collection and transmission” of data occurred outside California). 8 Plaintiffs’ amended averments in their FAC do not warrant a different conclusion than the 9 one reached in this Court’s 4/6 Order: namely, that California law does not apply nationwide for 10 Plaintiffs’ intrusion upon seclusion claim. Therefore, Plaintiffs’ intrusion upon seclusion claim— 11 to the extent it is brought on behalf of the United States Class under California law, as opposed to 12 solely on behalf of the California Sub-Class—is dismissed without leave to amend. 13 2. Third Cause of Action: Intrusion Upon Seclusion (Florida Common Law) 14 Plaintiffs, in the alternative, bring a claim for intrusion upon seclusion under Florida law 15 on behalf of the Florida-Class. To state a claim for intrusion upon seclusion under Florida law, a 16 plaintiff must show an intrusion onto a private place that would be highly offensive to a 17 reasonable person. Hammer v. Sorensen, 824 F. App’x 689 , 695 (11th Cir. 2020). Intrusions can be either physical or electronic. See Spilfogel v. Fox Broadcasting Co., 724, 726 (11th Cir. 2011). [18] The requirement in Florida that a plaintiff must “show an intrusion into a private place and not [19] merely a private activity” goes beyond the Restatement (Second) of Torts, which has no such [20] “private place” requirement. Id. (citing Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156 , 161 n.3, 162 [21] (Fla. 2003)). [22] As a general matter, courts have declined to extend Florida’s protections against the [23] invasion of privacy tort (of which intrusion upon seclusion is a subtype) to instances in which a [24] party accesses digital files. See Celestine v. Capital One, No. 17-cv-20237, 2017 WL 2838185 , at [25] *3 (S.D. Fla. June 30, 2017) (accessing a credit report does not constitute intrusion into a “place”); [26] Bradley v. City of St. Cloud, No. 12-cv-1348, 2013 WL 3270403 , at *5 (M.D. Fla. June 26, 2013) [27] 1 (similar, for medical records). In the FAC, Plaintiff Golbeck avers Oracle’s data collection 2 constitutes an intrusion into her home and her computer. FAC ¶ 163. Additionally, Plaintiffs cite 3 Hammer for the proposition that “private quarters” can include “electronic space.” Dkt. 67, at 22. 4 Defendant responds that Hammer’s reference to a potentially private email address is not analogous to “open conduct on the web.” Dkt. 70, at 5 n.11. Defendant argues non-private internet [5] activity does not occur in a “private place,” id., and Plaintiff Golbeck seems to acknowledge the [6] lack of cases finding collection of browsing data constitutes an intrusion into a private quarter, [7] Dkt. 67, at 23 (“No Florida case addresses any fact pattern that comes close to resembling the one [8] at bar.”). See, e.g., Rebalko v. City of Coral Springs, 552 F. Supp. 3d 1285 , 1333 (S.D. Fla. 2020) [9] (noting Florida courts have said “precious little” about what places, beyond a home, constitute a [10] private quarter). [11] Oracle has the better of this dispute. Accepting that an electronic space may constitute a [12] “private quarter,” see Spilfogel v. Fox Broadcasting Co., No. 9-cv-80813, 2010 WL 11504189 , at [13] *5 (S.D. Fla. May 4, 2010), Plaintiffs do not plausibly point to any particular “electronic space” [14] where Plaintiff Golbeck had a reasonable expectation of privacy into which Oracle intruded. Nor [15] do Plaintiffs plausibly aver Oracle intruded into Plaintiff Golbeck’s home. Thus, Plaintiffs have [16] not alleged sufficient facts to state a claim for intrusion upon seclusion under Florida law because [17] they have not alleged an intrusion into a “private place” or “private quarter.” For this reason, [18] Plaintiffs’ intrusion upon seclusion claim brought under Florida law must be dismissed with leave [19] to amend. [20] 3. Fourth, Fifth, and Sixth Causes of Action: CIPA (California), FSCA (Florida), [21] and ECPA (Federal Wiretap Act) [22] i. CIPA [23] Defendant argues Plaintiffs’ CIPA claim should be dismissed (1) because Plaintiffs do not [24] sufficiently allege Defendant had the requisite intent to violate CIPA or, in the alternative, (2) to [25] the extent the claim is premised on collection of the seven types of information this Court [27] 1 previously determined do not qualify as “contents.”8 2 First, Oracle points to California Penal Code § 631(a)’s requirement that contents subject 3 to CIPA be read (or attempted to be read) “willfully and without the consent of all parties to the 4 communication” and argues Plaintiffs have not pled sufficient facts Oracle had the requisite intent 5 here. Dkt. 63, at 16. Recording a confidential communication is intentional where the recording 6 entity has the “purpose or desire” of recording the communication or the “knowledge to a 7 substantial certainty” the communication will be recorded. People v. Sup. Ct. (Smith), 449 P.2d 8 230, 238 (Cal. 1969). Defendant cites Lozano v. City of Los Angeles, 73 Cal. App. 5th 711 , 727– 9 28 (Cal. Ct. App. 2022), as support for its position that the recording tool at issue here (the bk10 coretag.js) would not necessarily record the content of communications as opposed to record 11 information. Dkt. 63, at 17. Oracle further contends the causal chain of intention is broken by the 12 fact that its customers “choose what portion of the collected data they wish to share with Oracle” 13 and to obtain consent to collect the information from users. See id. at 17–18.9 14 Plaintiffs, however, have sufficiently alleged Oracle had “knowledge to a substantial 15 certainty” that deployment of the bk-coretag.js would record confidential communications. See, 16 e.g., Lopez v. Apple, Inc., 519 F. Supp. 3d 672 , 690 (N.D. Cal. 2021) (finding intent requirement 17 satisfied given Apple’s knowledge “accidental Siri triggers” would, with substantial certainty, 18 “occur in confidential contexts”). Plaintiffs aver Oracle’s products—such as the bk-coretag.js—are 19 implemented by websites and collect vast quantities of personal information that eventually makes 20 its way back to Oracle. See, e.g., FAC ¶¶ 44–46. Plaintiffs further claim this data collection occurs 21 despite Oracle’s knowledge that many users do not consent to it. See, e.g., id. ¶¶ 59 , 107–108. 22 Such averments, like those in Lopez, are sufficient at this stage to satisfy the intent requirement. [24] 8 Those categories are webpage titles, webpage keywords, the date and times of website visits, IP 25 addresses, page visits, purchase intent signals, and add-to-cart actions. These categories of data are not “content” regardless of whether Plaintiffs actually conceded the issue. See, e.g., Dkt. 67, at 5. [26] 9 This “chain of causation” argument echoes the Article III standing arguments Oracle made in its 27 previous motion to dismiss. 1 Second, solely to the extent Plaintiffs’ CIPA claim avers referrer URLs and data entered into 2 forms are “content,” Plaintiffs have met their burden (as they did on Defendant’s first motion to 3 dismiss) to plead sufficient facts to withstand dismissal. Therefore, Plaintiffs’ CIPA claim 4 survives. 5 ii. FSCA 6 Oracle moves to dismiss Plaintiffs’ FSCA claim for failure to state a claim on two primary 7 grounds: (1) information obtained by the bk-coretag.js is not “electronic communication” as 8 defined by the statute and (2) Plaintiffs lack a reasonable expectation of privacy in the 9 information. Dkt. 63, at 18–21. Neither argument persuades. 10 The histories of the FSCA and the Federal Wiretap Act are instructive regarding what 11 constitutes electronic communication. As Oracle acknowledges, the Florida Legislature amended 12 the FSCA (extending the statute to cover “electronic communication”) in tandem with Congress’s 13 similar modification of the Federal Wiretap Act. See Dkt. 63, at 20; see also State v. Jackson, 650 14 So.2d 24 , 27 (Fla. 1995) (similar). The Federal Wiretap Act and FSCA appear to define 15 “electronic communication” identically. Compare 18 U.S.C. § 2510 (12) with Fla. Stat. 16 § 934.02(12). While Defendant is correct that both statutes exclude any device which “permits the 17 tracking of the movement of a person or an object,” see, e.g., Fla. Stat. § 934.02 (12)(c), the cases 18 Defendant cites relate primarily to the use of session replay software. See, e.g., Jacome v. Spirit 19 Airlines Inc., No. 2021-947, 2021 WL 3087860 , at *3 (Fla. Cir. Ct. June 17, 2021). Plaintiffs 20 respond that the bk-coretag.js is script not analogous to such software, see Dkt. 67, at 21, a 21 contention Oracle disputes on the grounds the two tools capture the same types of information, see 22 Dkt. 70, at 10. 23 Plaintiffs have the better of this disagreement. Fla. Stat. § 934.02 (12)(c) specifically 24 excludes from its definition of electronic communications any communications from a “device 25 which permits the tracking of the movement of a person or an object” (emphasis added). Oracle 26 does not claim the bk-coretag.js literally tracks “movement” within the meaning of the statute. 27 Second, Oracle’s argument that what matters is whether the bk-coretag.js captures the “same 1 information” as session replay software goes too far. The First Circuit, for instance, has already 2 interpreted the Federal Wiretap Act’s definition of electronic communication to include 3 “[t]ransmissions of completed online forms.” In re Pharmatrak, Inc., 329 F.3d 9 , 18 (1st Cir. 4 2003). In so doing, it noted the Act “adopts a ‘broad, functional’ definition of an electronic 5 communication.” Id. (quoting Brown v. Waddell, 50 F.3d 285, 289 (4th Cir. 1995)). This 6 definition of “electronic communication” is sufficiently broad to encompass referrer URLs. 7 Therefore, to the extent the FSCA tracks the Federal Wiretap Act, at least some of the 8 transmissions the bk-coretag.js allegedly captured—transmissions containing “data entered by the 9 user into forms” on various websites, FAC ¶¶ 183, and referrer URLs—constitute electronic 10 communications under the FSCA. 11 Second, assuming (without deciding) Defendant is correct Plaintiffs must have a 12 reasonable expectation of privacy in electronic communications under the FSCA,10 Plaintiffs have 13 met this burden. One of Plaintiffs’ central contentions is that users do not actually consent to either 14 Defendant’s or third-party websites’ collection of information about their internet browsing and 15 that they had a corresponding privacy interest in that information. Plaintiffs have sufficiently pled 16 a reasonable expectation of privacy in at least some of the information they aver Defendant 17 compiled through an extensive data collection and profiling scheme. Thus, Plaintiffs’ FSCA claim 18 survives. 19 iii. ECPA 20 Plaintiffs add averments to their FAC, see FAC ¶¶ 226–230, in a renewed attempt to [22] 10 Plaintiffs persuasively argue the FSCA does not require a reasonable expectation of privacy in 23 electronic communications. In Brevard Extraditions, Inc. v. Fleetmatics, USA, LLC, the court noted the different definitions of “wire communication” and “oral communication” in the FSCA, 24 the explicit reference to privacy expectations in the statute’s definition of the latter, see Fla. Stat. § 934.02 (2), and the fact that wire communications are “generally protected regardless of whether 25 the person making or receiving the communication has an expectation of privacy.” No. 12-cv2079, 2013 WL 5437117 , at *4 (M.D. Fla. Sept. 27, 2013) (citing PBA Local No. 38 v. 26 Woodbridge Police Dep’t, 832 F. Supp. 808 (D.N.J. 1993)). Section 934.02(12) of the FSCA, which defines “electronic communication”—like the definition of “wire communication” and 27 unlike the definition of “oral communication”—contains no reference to expectations of privacy. 1 demonstrate “the primary motivation or a determining factor in [Oracle’s] actions” in the context 2 of intercepting communications “has been to injure plaintiffs tortiously.” See Rodriguez v. Google 3 LLC, No. 20-cv-04688-RS, 2021 WL 2026726 , at *6 n.8 (N.D. Cal. May 21, 2021) (declining to 4 apply crime-fraud exception where company did not intend to injure plaintiffs tortiously) (citing In 5 re Google Inc. Gmail Litig., No. 13-md-02430, 2014 WL 1102660 , at *18 n.13 (N.D. Cal. Mar. 6 18, 2014)). As support for their claim, Plaintiffs (1) cite Oracle CEO Larry Ellison’s comments 7 about how the company’s data-collection abilities were “scaring the lawyers” and (2) argue the 8 goal of “making money” cannot sanitize tortious conduct. FAC ¶¶ 227-28. Without more, 9 Plaintiffs have not alleged sufficient facts that Oracle intercepted data with the primary motivation 10 or purpose of committing torts on internet users.11 11 Plaintiffs cite Brown v. Google, LLC, 525 F. Supp. 3d 1049 , 1067 (N.D. Cal. 2021)—a 12 case where the crime-fraud exception was found to apply—and argue this case is analogous. 13 Defendant effectively distinguishes this case and Brown; for instance, Defendant points out how 14 the plaintiffs in Brown had identified internal Google communications referring to the company’s 15 privacy practices as problematic. Dkt. 70, at 11; Brown, 525 F. Supp. 3d at 1079; see also In re 16 Google Inc. Gmail Litig., 2014 WL 1102660 , at *18 n.13 (finding failure to show necessary 17 wrongful intent). Plaintiffs have not pled sufficient facts here to show Oracle had tortious 18 motivation. Thus, for the reasons discussed in this Court’s prior order dismissing Plaintiffs’ ECPA 19 claim in light of Defendant’s consent defense, Plaintiffs’ ECPA claim must be dismissed. See 4/6 20 Order, at 16. 21 4. Seventh & Eighth Causes of Action: Unjust Enrichment 22 i. Unjust enrichment under California law 23 Plaintiffs’ FAC successfully pleads an unjust enrichment cause of action under California [25] 11 The mere possibility Oracle’s data collection activities could at some future date be deemed 26 tortious does not justify application of the crime-fraud exception in these circumstances. See, e.g., In re DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497 , 518–19 (S.D.N.Y. 2001) (noting “a 27 culpable mind does not accompany every tortious act”). 1 law. In order “[t]o allege unjust enrichment as an independent cause of action, a plaintiff must 2 show that the defendant received and unjustly retained a benefit at the plaintiff’s expense.” ESG 3 Cap. Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016). The benefit Plaintiffs claim 4 Oracle received and retained here is information—both from third-party websites and 5 independently collected—about Plaintiffs’ online and real-world lives. 6 Plaintiffs now aver they “were not aware of Oracle’s conduct while browsing websites” 7 (ostensibly websites incorporating the bk-coretag.js or other Oracle technology), and “would not 8 have visited those websites” or, in the alternative, would have taken steps while visiting the 9 websites “to avoid being tracked and profiled by Oracle.”12 FAC ¶ 249(a). Oracle’s collection of 10 data from third-party websites, Plaintiffs argue, conferred a benefit upon Oracle at the expense of 11 the privacy of their data. Id. ¶ 248 –249. Plaintiffs also allege Defendant has collected their real12 world location information, and then compiled and sold that information, without their consent. Id. 13 ¶ 249(b)-(c). With their added averments, Plaintiffs have done just enough for their unjust 14 enrichment cause of action under California law to survive. 15 ii. Choice of law 16 Defendant argues Plaintiffs cannot assert an unjust enrichment claim under California state 17 law on behalf of non-California residents—on behalf of either a named plaintiff, Golbeck (a 18 Florida resident), or classes inclusive of non-residents, such as the United States class—and seeks 19 dismissal of Plaintiffs’ claims to that extent. 20 As before, both parties agree “[a] federal court sitting in diversity must look to the forum 21 state's choice of law rules,” thus requiring the court to apply California’s “governmental interest 22 approach” to determine questions of choice of law. Zinser v. Accufix Rsch. Inst., Inc., 253 F.3d 23 1180, 1187 (9th Cir. 2001). This is a three-step process. The first task is to determine whether the [24] 25 12 Plaintiffs also cite Brooks v. Thomson Reuters Corp. as persuasive authority for allowing an unjust enrichment claim to proceed in the context of a data broker’s alleged violation of privacy 26 rights. No. 21-cv-1418, 2021 WL 3621837 , at *11–12 (N.D. Cal. Aug. 16, 2021). There, however, the court merely rejected defendant’s argument regarding whether unjust enrichment can be 27 asserted as a standalone cause of action. Id. at *11 . 1 laws of the affected jurisdictions are “the same or different.” Mazza, 666 F.3d at 590 (quoting 2 McCann v. Foster Wheeler LLC, 48 Cal. 4th 68, 81-82 (2010)). If the laws are different, the 3 second step requires an examination of “each jurisdiction’s interest in the application of its own 4 law” to determine whether a true conflict exists. Id. If it does, then the final step involves 5 analyzing “which state’s interest would be more impaired if its policy were subordinated to the 6 policy of the other state.” Id. 7 First, Oracle persuasively contends California and Florida have significantly different 8 standards for unjust enrichment claims on the grounds that Florida—but not California—requires 9 (1) the recipient of a benefit to have “knowledge” of and to “accept” the benefit and (2) that the 10 benefit be directly conferred on the defendant. See Dkt. 63, at 7; see also Kopel v. Kopel, 229 11 So.3d 812 , 818 (Fla. 2017) (“the plaintiff must directly confer a benefit to the defendant”). It is 12 possible an unjust enrichment claim could succeed in California but fail in Florida on the grounds 13 the conferred benefit was insufficiently direct. See Gustafson v. BAC Home Loans Servicing, LP, [14] 294 F.R.D. 529, 548 (C.D. Cal. 2013); see also Virgilio v. Ryland Group, Inc., 680 F.3d 1329 , 15 1337 (11th Cir. 2012) (finding third party, and not the plaintiffs, conferred the relevant benefit 16 where third party “bargained away” its rights to the benefit). As Oracle notes, the Ninth Circuit 17 has held the “elements necessary to establish a claim for unjust enrichment also vary materially 18 from state to state.” Mazza v. Am. Honda Motor Co., 666 F.3d 581, 591 (9th Cir. 2012). Though 19 Plaintiffs represent they will offer the same proof under either California’s or Florida’s test, this 20 does not alter the fact that the two States have materially different standards. 21 Next, a true conflict exists. Florida has a strong interest in determining how to balance 22 protecting consumers and attracting business. See, e.g., Mazza, 66 F.3d at 591–93. Florida 23 indisputably has an interest in applying its own consumer protection laws to its own residents. 24 Third, California’s interest in applying its unjust enrichment law to non-California residents is 25 attenuated. See In re Toyota RAV4 Hybrid Fuel Tank Litig., 534 F. Supp. 3d 1067 , 1122 (N.D. 26 Cal. 2021 ) (applying Mazza). As in Mazza and In re Toyota, the States in which relevant 27 transactions occur have the stronger interest in policing those transactions. For these reasons, 1 Plaintiffs’ unjust enrichment claim under California law on behalf of the United States Class 2 cannot stand. Plaintiffs’ unjust enrichment claim under California law on behalf of the United 3 States Class is dismissed with leave to amend. 4 iii. Florida law (eighth cause of action) 5 Given the survival of Plaintiffs’ unjust enrichment claim under California law and the fact 6 California law cannot be applied to the United States Class, it is necessary to assess Plaintiffs’ 7 unjust enrichment cause of action pled, in the alternative, under Florida law. Plaintiffs bring this 8 cause of action on behalf of the Florida Sub-Class. To state a claim for unjust enrichment in 9 Florida, a plaintiff must show the plaintiff directly conferred a benefit on the defendant. Kopel, 10 229 So.3d at 818. Further, the plaintiff must show the defendant voluntarily accepted and retained 11 the benefit and that it would be inequitable for the defendant to retain the benefit without 12 compensating the plaintiff. Peoples Nat. Bank of Commerce v. First Union Nat. Bank of Fla., 667 13 So.2d 876 , 879 (Fla. Dist. Ct. App. 1996). 14 Oracle first contends Plaintiffs received the benefit of their bargain because they were able 15 to access third-party websites despite the collection of their data. Plaintiffs, as they did for their 16 unjust enrichment claim under California law, have added sufficient averments to the FAC to 17 explain why the access they gained to third-party websites does not defeat their claim. Oracle also 18 posits that Plaintiffs have failed to show any direct conferral of a benefit because Oracle’s 19 customers are “necessary intermediaries between Golbeck and Oracle.” Dkt. 63, at 24–25. 20 Plaintiffs correctly point out that the mere existence of an intermediary through which a benefit 21 travels does not doom an unjust enrichment claim under Florida law. Dkt. 67, at 24; see, e.g., 22 Weinberg v. Advanced Data Processing, Inc., 147 F. Supp. 3d 1359, 1368 (S.D. Fla. 2015). In its 23 reply papers, Oracle contends there was no direct conferral of a benefit because its third-party 24 customers merely transmit data to Oracle which Oracle then must process into interest segments 25 and sell to advertisers. Dkt. 70, at 14. 26 One complication at this stage is that Plaintiffs refer both to the “personal and sensitive 27 data” Oracle receives, FAC ¶ 251, as well as Oracle’s revenue from selling such data, id. ¶ 249, in 1 explaining how Oracle was unjustly enriched. Oracle, though, does not seem to contest that “data” 2 transferred from one party to another can constitute a benefit.13 It comes closest to doing so in its 3 reply papers when it insinuates the benefit must have been revenue earned from data rather than 4 data itself. Dkt. 70, at 14. Even had this issue been squarely addressed by the parties, Florida 5 courts evaluating unjust enrichment claims have found a benefit need not be a clearly defined 6 property interest. See Cohen v. Kravit Estate Buyers, Inc., 843 So.2d 989, 992 (Fla. Dist. Ct. App. 7 2003) (“No property interest is required.”); F.H. Paschen, S.N. Nielsen & Assocs. LLC v. B&B Site 8 Dev., Inc., 311 So.3d 39 , 50 (Fla. Dist. Ct. App. 2021) (asphalt removal and replacement 9 constitutes benefit). 10 Given that personal data would appear to qualify as a benefit under Florida law, Plaintiffs 11 have a persuasive argument that the presence of intermediaries—here, third-party websites—poses 12 no obstacle to the requirement a benefit be directly conferred. Plaintiffs have averred sufficient 13 facts at this stage that they conferred a direct benefit on Oracle,14 and, thus, their unjust 14 enrichment claim under Florida law survives. 15 5. Ninth Cause of Action: Declaratory and Injunctive Relief 16 Finally, Defendant seeks to dismiss Plaintiffs’ cause of action for declaratory judgment and 17 injunctive relief. This cause of action rises and falls with Plaintiffs’ other claims: if Plaintiffs fail 18 to allege facts sufficient to state a claim under any other cause of action, the claim for declaratory 19 judgment and injunctive relief will be dismissed. Since not all of Plaintiffs’ claims have been 20 dismissed, this cause of action moves forward at this stage. [23] 24 13 At least one court has struggled with what constitutes a “benefit”—where the claimed benefit is not money—in an unjust enrichment claim brought under Florida law in the context of eventually25 monetized data. See Muy v. Int’l Bus. Mach. Corp., No. 19-cv-14, 2019 WL 8161745 , at *1 (N.D. Fla. July 19, 2019). [26] 14 It is conceivable further factual development might reveal, for instance, that raw personal data 27 lacks any commercial value before it is “transform[ed].” See Dkt. 70, at 14 n.26. 1 IV. MOTION TO SEAL 2 Plaintiffs also have a pending administrative motion to seal the OARRRs. See Dkt. 75. 3 There is a strong presumption in favor of allowing public access when deciding whether materials 4 should be sealed. See Apple Inc. v. Psystar Corp., 658 F.3d 1150, 1162 (9th Cir. 2011). A request 5 to seal must be narrowly tailored. Civ. L.R. 79-5(c)(3). To overcome the presumption in favor of public access to a judicial record, there generally must be “compelling reasons supported by [6] specific factual findings.” Kamakana v. City & Cty. of Honolulu, 447 F.3d 1172 , 1178 (9th Cir. [7] 2006) (“The mere fact that the production of records may lead to a litigant's embarrassment, [8] incrimination, or exposure to further litigation will not, without more, compel the court to seal its [9] records.”). Where a litigant presents compelling reasons to seal material, the court must then [10] balance the interests of the public and the party seeking sealing. Ctr. for Auto Safety v. Chrysler [11] Grp., LLC, 809 F.3d 1092 , 1096–97 (9th Cir. 2016). This balancing test involves such factors as [12] the public’s interest in understanding the functioning of the judicial process and the volume of [13] material sought to be sealed. See Zakinov v. Ripple Labs, Inc., No. 18-cv-6753, 2023 WL 14 5280193, at *1 (N.D. Cal. Aug. 15, 2023). [15] Plaintiffs have offered two sets of potential redactions15 to the OARRRs in response to the [16] direction for more narrowly tailored sealing requests. They argue redactions are necessary to [17] protect Plaintiffs’ privacy because the OARRRs reveal many details about Plaintiffs’ private lives. [18] See, e.g., Dkt. 75, at 5 (listing the types of information the OARRRs reveal). Plaintiffs explain the [19] OARRRs implicate privacy interests in part through the unique “totality of the segments [20] categories attributed” to an individual. Id. at 3 . In other words, Plaintiffs argue the OARRRs need [21] to be considered both at a micro- (e.g., values for specific categories) and macro-level. Though [22] Defendants did not previously oppose Plaintiffs’ motion to seal, they now argue the information [23] Plaintiffs seek to seal is insufficiently sensitive and that Plaintiffs do not explain how its [25] 26 15 Exhibits A and B to the Maher Declaration contain more extensive redactions as compared to Exhibits E and F. Plaintiffs offer the second set of more tailored redactions in case the first set is 27 deemed overly broad. See Dkt. 75, at 1. 1 publication could lead to harm. See Dkt. 76, at 2–5. Defendants appear to contest the idea that any 2 of the contested information in the OARRRs is sealable. 3 On one hand, Plaintiffs’ argument about the privacy interests implicated by the “totality” 4 of attributed segments categories goes too far in that it—if taken to its logical conclusion—would 5 seem to require sealing the OARRRs in their entirety (encompassing terms like “Ad Occurrence”). 6 On the other hand, Plaintiffs’ larger point that the release of a detailed dossier of information 7 about an individual that, by virtue of its comprehensiveness, implicates privacy concerns is 8 compelling. It would be perverse to hold an individual entitled to no protection where a company 9 amalgamates many pieces of information about that individual’s preferences on the grounds that 10 revealing any one preference is no big deal. Plaintiffs clearly have a privacy interest in their “likes, 11 dislikes, interests, and habits over a significant amount of time.” In re Facebook, Inc. Internet 12 Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020). Many pieces of information in the OARRRs 13 indicate more than simple likes or dislikes and instead communicate intimate details of Plaintiffs’ 14 daily lives. 15 For the foregoing reasons, Plaintiffs’ proposed redactions to Exhibits E and F to the Maher 16 Declaration are sufficiently tailored, and Plaintiffs’ motion to seal the OARRRs will be granted to 17 reflect those redactions. Plaintiffs’ privacy interest in the redacted portions of the OARRRs 18 outweighs the public’s interest in fully-disclosed documents in this instance. This is so in part 19 given that the OARRRs, even with redactions, still communicate to the public the types of 20 information that are at issue in this action. Of course, reasonable minds might disagree on 21 distinguishing between which entries in the “Segment Category” column merit sealing and which 22 do not, but Plaintiffs have, at this stage, met their burden to propose a narrowly tailored set of 23 redactions. 24 V. CONCLUSION 25 In light of the above, Plaintiffs’ intrusion upon seclusion claim on behalf of the Florida 26 Sub-Class under Florida law is dismissed with leave to amend. To the extent Plaintiffs bring an 27 intrusion upon seclusion claim under California law on behalf of the United States Class, that 1 claim is dismissed without leave to amend. To the extent Plaintiffs bring an unjust enrichment 2 claim under California law on behalf of the United States Class, that claim is dismissed with leave 3 to amend. Additionally, Plaintiffs’ ECPA claim is dismissed with leave to amend. Plaintiffs’ 4 || remaining claims—intrusion upon seclusion under California law on behalf of the California Sub5 Class, invasion of privacy, CIPA, FSCA, unjust enrichment, declaratory judgment, and injunctive 6 || relief—survive. Plaintiffs are given 20 days to file an amended complaint. 7 Plaintiffs’ motion to seal as reflected in the category-by-category redactions in Exhibits E 8 and F to the Maher Declaration is granted. Plaintiffs are ordered to file public versions of both 9 exhibits consistent with this order, no later than October 20, 2023. [10] 11 IT IS SO ORDERED. [12] €& 1 Dated: October 3, 2023 RICHARD SEEBORG 15 Chief United States District Judge [16] = 17 Z 18 [27] 28 ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS CASE No. 22-cv-04792-RS