Smith v. Google, LLC

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA [6] 7 MARY L. SMITH, et al., Case No. 23-cv-03527-PCP 8 Plaintiffs, ORDER DENYING MOTION TO 9 v. DISMISS 10 GOOGLE, LLC, Defendant. [12] 13 In this consolidated putative class action against Google, LLC, plaintiffs bring several state 14 and federal law claims arising from Google’s alleged collection of their financial data through 15 tracking tools installed on several tax preparation websites. Google has moved to dismiss these 16 claims and seeks judicial notice of certain documents. For the reasons that follow, Google’s 17 requests for judicial notice are granted and its motion to dismiss is denied. 18 I. Background 19 The following facts from the complaint are accepted as true for purposes of this motion. 20 Google operates a well-known search engine and many other internet services and 21 products. Google makes most of its money selling ads. Its advertising tools allow advertisers to 22 target a specific location, language, and audience. Google also offers tools that track how users 23 interact with websites. These tools can track groups of users who behave similarly or share 24 characteristics like age or gender. They can also track specific user actions on websites, like the 25 number of clicks, scrolls, searches, or downloads. These tools can link all of the data associated 26 with a single user. This data can measure how effective ads are and monitor how users behave. 27 One such tool is Google Analytics. Website owners can install an “invisible” snippet of 1 Analytics installed, the tracking code collects pseudonymous information about how the user 2 interacts with the webpage. By default, Google Analytics collects information about the user’s 3 browser, language, clicks, downloads, and form interactions, as well as the titles of webpages, and 4 matches the information it collects with a user’s location, gender, and general interests. Google 5 also offers a more powerful tracking tool called the Google Tag. This allows sophisticated web 6 publishers to customize what data is collected and how it is processed. 7 Data collected by these tools is sent in real time to Google, which stores the data and 8 processes it into reports. According to the complaint, Google benefits from this collection because 9 it can use the data to power its algorithms and learn about user habits. The complaint alleges that 10 Google uses this data to assemble a “detailed dossier” for Google users and other website visitors. 11 H&R Block, TaxAct, and TaxSlayer are online tax filing services. The complaint alleges 12 that H&R Block “transmitted information about tax filers’ fillings to Google” (although it does not 13 allege which specific tracking tools or products H&R Block used). The complaint alleges that both 14 TaxAct and TaxSlayer disclosed “adjusted gross income and refund amounts” to Google. 15 Google purportedly prohibits Google Analytics customers from “passing any information 16 that could be used by Google to identify individuals.” According to the complaint, Google has 17 never contacted any of the tax preparation sites about their sharing potentially sensitive 18 information with Google, nor has Google suspended or terminated any of these sites’ accounts. 19 The named plaintiffs are residents of California, Florida, Georgia, Illinois, New York, 20 South Carolina, and Texas who used TaxAct, H&R Block, and TaxSlayer to prepare their taxes. 21 Each alleges that the site they used to file taxes had installed Google’s tracking tools. Plaintiffs 22 seek to represent a nationwide class of people who used online tax providers like H&R Block, 23 TaxAct, or TaxSlayer that used Google tracking tools, as well as California, Illinois, Florida, and 24 Texas subclasses. 25 Plaintiffs filed the present consolidated complaint after the Court consolidated two similar 26 cases. Plaintiffs assert eight claims under a variety of state and federal laws on behalf of the 27 putative nationwide class and state subclasses. Google has moved to dismiss the complaint under 1 II. Legal Standards 2 A complaint that does not state a plausible claim upon which relief can be granted can be 3 dismissed under Federal Rule of Civil Procedure 12(b)(6). “A claim has facial plausibility when 4 the plaintiff pleads factual content that allows the court to draw the reasonable inference that the 5 defendant is liable.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Legal conclusions “must be 6 supported by factual allegations.” Id. at 679 . The Court must “accept all factual allegations in the 7 complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” 8 Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028 , 1029–30 (9th Cir. 2009). 9 There are two exceptions to the general rule that “courts may not consider material outside 10 the pleadings when assessing the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics, 11 Inc., 899 F.3d 988, 998 (9th Cir. 2018). First, Federal Rule of Evidence 201 permits judicial notice 12 of “a fact that is not subject to reasonable dispute” because the fact is “generally known” or “can 13 be accurately and readily determined from sources whose accuracy cannot reasonably be 14 questioned.” A court may take notice of “undisputed matters of public record,” but not of 15 “disputed facts stated in public records.” Lee v. City of L.A., 250 F.3d 668, 690 (9th Cir. 2001). 16 Second, the doctrine of incorporation by reference permits a court to treat an extrinsic document as 17 if it were part of the complaint if the pleading “refers extensively to the document” or if “the 18 document forms the basis” of a claim. Khoja, 899 F.3d at 1002 . This can be proper “when 19 assessing the sufficiency of a claim requires that the document at issue be reviewed,” but is not 20 warranted when “the document merely creates a defense to the well-ple[aded] allegations.” Id. 21 III. Requests for Judicial Notice 22 Google has requested judicial notice of several documents. These requests are granted. 23 First, Google seeks judicial notice of the “Google Analytics Terms of Service” posted on 24 its website. Google argues that this document is noticeable because it is posted on a public website 25 and, alternatively, because it is incorporated by reference into the complaint. Although the 26 complaint refers to “policies” that Google purportedly has in place, Compl. ¶ 42, this is not 27 enough for the document to be incorporated by reference. The complaint’s indirect reference to 1 claims arise from or depend on that agreement. Still, the Court takes notice of this document 2 because it is publicly available from a source whose accuracy cannot reasonably be questioned and 3 its contents can be accurately determined. But this notice is limited to the existence and contents 4 of this May 15, 2023 version of the document. The Court cannot conclude that any of the tax 5 preparation sites ever assented to the terms therein, or that plaintiffs had notice of the contents. 6 Second, Google seeks judicial notice of two other pages on its website that discuss Google 7 Analytics. This request is similarly granted, but notice is again limited to the existence of these 8 documents. The Court cannot conclude that these documents—a blog post addressing “Google 9 Analytics privacy” and a support article identifying “[b]est practices to avoid sending Personally 10 Identifiable Information”—accurately characterize how Google’s tools operate. 11 Third, Google requests judicial notice of copies of the “TaxAct Privacy Policy,” the “H&R 12 Block Privacy Policy,” and the “TaxSlayer Privacy Policy” posted on the tax preparation services’ 13 respective websites. These documents are not incorporated by reference, but the Court will 14 similarly take judicial notice of them because they are posted publicly. As before, though, the 15 Court cannot conclude that any of the plaintiffs ever saw or agreed to the terms therein, or that the 16 tax preparation companies operated in compliance with those policies. 17 Finally, Google requests judicial notice of purported additional versions of the Google 18 Analytics Terms of Service, the H&R Block Privacy Notice, the TaxAct Privacy Statement, and 19 the TaxSlayer Privacy Policy. These versions cover a broader range of effective dates than 20 Google’s original submission and are all taken from the Internet Archive’s “Wayback Machine” 21 archival service. This request is similarly granted but, again, judicial notice of the existence of 22 these documents in the Wayback Machine archive cannot support any conclusions regarding their 23 terms, plaintiffs’ consent to those terms, or Google’s compliance with those terms. 24 IV. Motion To Dismiss 25 Google seeks dismissal of each of plaintiffs’ claims. The Court addresses them in turn. 26 A. Count I: California Invasion of Privacy Act ( Cal. Penal Code § 631 ) 27 Section 631(a) of the California Penal Code makes punishable anyone who, “by means of 1 (1) “intentionally taps, or makes any unauthorized connection, whether physically, electrically, 2 acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or 3 instrument …”; 4 (2) “willfully and without the consent of all parties to the communication, or in any 5 unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any 6 message, report, or communication while the same is in transit or passing over any wire, 7 line, or cable, or is being sent from, or received at any place within this state”; 8 (3) “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any 9 way, any information so obtained”; or 10 (4) “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or 11 permit, or cause to be done any of the acts or things mentioned above in this section.” 12 Section 631 is a criminal statute, but Section 637.2 provides a civil cause of action to anyone 13 “injured by a violation of this chapter … against the person who committed the violation.” 14 Google raises several challenges to the Section 631 claim. Because none have merit at this 15 stage, its motion to dismiss the claim under prongs two and three of Section 631 is denied.1 16 1. Consent 17 Google first argues that plaintiffs consented to the tax sites’ use of Google Analytics. 18 Google argues that terms of service and privacy policies of which the Court has taken judicial 19 notice establish that plaintiffs consented to the use of Google Analytics. Although these 20 documents suggest that plaintiffs could have consented to Google’s alleged data collection, 21 plaintiffs specifically allege that they did not. The mere existence of various terms of service and 22 privacy policies cannot establish at this stage, where the Court must draw all reasonable inferences 23 in plaintiffs’ favor, that any of the plaintiffs did in fact consent. Google’s consent arguments do 24 not provide a basis to dismiss the Section 631 claim. See In re Meta Pixel Tax Filing Cases, ––– F. 25 Supp. 3d ––––, 2024 WL 1251350 , at *5 (N.D. Cal. 2024) (rejecting similar consent arguments). [27] 1 2. Vendor 2 Google next argues that the Section 631 claim should be dismissed because Google acted 3 as a “mere vendor” of a tool that allows websites to record their own interactions with their users. 4 Under Section 631, “it … matter[s] who is holding the tape recorder.” Javier v. Assurance 5 IQ, LLC, 649 F. Supp. 3d 891 , 900 (N.D. Cal. 2023). If a party to a conversation uses a recording 6 device to capture it, Section 631 is not violated. See Rogers v. Ulrich, 52 Cal. App. 3d 894 , 899 7 (1975) (explaining that Section 631 does not cover “participant recording”).2 But if a nonparty to a 8 conversation listens in directly or records the conversation themselves, they are generally liable 9 under Section 631 if the other elements of that claim are satisfied. See Ribas v. Clark, 38 Cal. 3d 10 355 , 360–61 (1985) (explaining that Section 631 covers “simultaneous dissemination to an 11 unannounced second auditor, whether that auditor be a person or mechanical device”). 12 If Google Analytics is like a tape recorder, the question is who is “holding” it. Did Google 13 simply build a tape recorder and pass it off to the tax sites to use for their own purposes? Or did 14 Google not only create the tape recorder but also use it to make a recording? The former scenario 15 might not violate Section 631 under Rogers, but the latter would under Ribas. Some courts have 16 concluded that web tracking tools are like a tape recorder that is simply handed off to website 17 operators to collect data on their own users, even if the maker of the recording tool stores the data. 18 In Graham v. Noom, Inc., for example, one court in this district explained that “a software service 19 that captures its clients’ data, hosts it on [its own] servers, and allows the clients to analyze their 20 data” is simply “a tool—like the tape recorder in Rogers—that allows [a client] to record and 21 analyze its own data.” 533 F. Supp. 3d 823 , 832–33 (N.D. Cal. 2021). But another court in this 22 district recently concluded that for an online tracking service to be more like a tape recorder 23 device than an eavesdropper using a tape recorder, the service must be entirely incapable of using 24 the data it collects and stores for any other purpose, “just as a tape recorder has no independent 25 capability to divulge the recording.” See Javier, 649 F. Supp. 3d at 900. Such a service might, for 26 example, encrypt the data it collects so that only the website developer, not the service provider, [27] 1 can access the unencrypted data. 2 Whether or not a third-party service incapable of using the data it collects might avoid 3 liability under Section 631, the complaint alleges that Google does read and use Google Analytics 4 data. It asserts that “Google Analytics … is not simply a ‘tool’ utilized by website owners for their 5 own purposes” but that Google “benefits (and profits from)” the use of Google Analytics and “can 6 use the data it gleans … to power its algorithms.” Compl. ¶ 29. It asserts that Google uses the data 7 from its tracking tools to compile a “detailed dossier, or digital fingerprint” for each of its users. 8 Id. Google Analytics is free, suggesting that Google derives some benefit when websites use the 9 tool. And when a website installs Google Analytics, “by default, Google Analytics matches that 10 information with users’ geolocation, gender, and general interests.” Compl. ¶ 34. The complaint is 11 not entirely clear about whether the user information that is “matched” is exclusively information 12 collected from a particular website or whether Google compares information collected through 13 web tracking tools to other information Google has already amassed, but it seems unlikely that tax 14 preparation websites sent Google information about their users’ “general interests.” Either way, 15 the complaint alleges that the collected data is “aggregated” and presented to Google Analytics 16 customers in an online “account dashboard.” Compl. ¶ 34. This suggests that Google processes 17 and analyzes the data it collects at least to some extent. Even if this processing is done primarily 18 for the benefit of Google Analytics users, Google is still the one “reading” and/or “using” the data 19 it collects for the purposes of Section 631. See also Valenzuela v. Nationwide Mut. Ins. Co., ––– F. 20 Supp. 3d ––––, 2023 WL 5266033 , at *7 (C.D. Cal. 2023) (“Eavesdropping on a conversation at 21 the time it occurs is a violation of Section 631, even if done for the benefit of a party to the 22 conversation.”). 23 Plaintiffs’ allegations, which must be taken as true, suggest that Google is not simply a 24 vendor of a tool that websites can use to “record” their own users’ interactions on their websites, 25 but rather that Google read or used the data collected about these users. Although Google can 26 provide evidence to refute these allegations at a later stage, on this Rule 12(b)(6) motion Google’s 27 device-vendor arguments do not provide a basis to dismiss plaintiffs’ Section 631 claim. 1 3. Intent 2 Finally, Google argues that the Section 631 claim fails because the complaint does not 3 adequately plead intent. The complaint asserts that Google “intentionally tapped” plaintiffs’ 4 communications and “willfully … read or attempted to read” their contents. Compl. ¶¶ 61–62. The 5 complaint acknowledges that Google has policies to prohibit customers from sending personally 6 identifiable information to Google, but it also contends that Google never enforced these policies 7 against any of the tax preparation sites and that it “would have known” of or “at best … turned a 8 blind eye to” the use of its tools to collect users’ tax information. Compl. ¶¶ 40, 42–43. The 9 complaint further alleges that the information transmitted to Google would have been “highly 10 valuable” as a “demographic marker[] for advertising purposes.” Compl. ¶ 40. 11 These allegations are sufficient to plead willfulness for the purposes of Rule 12(b)(6). 12 While Google argues that judicially noticeable policy documents suggest that Google did not 13 actually want to receive personally identifiable information and expressly prohibited developers 14 from transmitting such data, this presents a question of fact that the Court cannot resolve at this 15 stage. See Meta Pixel, 2024 WL 1251350 , at *5 (“Whatever agreements may have been in place, 16 those agreements do not establish as a matter of law that Meta did not intend to receive the 17 information plaintiffs claim was transmitted.”). 18 Plaintiffs also note in their opposition brief that even under the higher Rule 9(b) standard, 19 intent can be averred generally. Google latches onto this passing reference to argue that plaintiffs 20 have “back[ed] themselves into the strictures of Rule 9(b)” and that plaintiffs’ “salacious 21 allegation” that Google prohibits websites from sending personal information but in fact intended 22 that websites do so means that their claims are subject to Rule 9(b). That is not how Rule 9(b) 23 works. Plaintiffs’ statutory claims here do not sound in fraud. Their claim requires intent, which 24 plaintiffs have specifically alleged. That Google also allegedly misrepresented its true intent is a 25 separate issue from whether Google actually did intend to receive the data. Because plaintiffs are 26 directly challenging Google’s alleged data collection rather than challenging any potentially 27 fraudulent or misleading representations about this collection, their claims do not sound in fraud 1 4. Contents 2 The second and third prongs of Section 631 require reading, learning, or using the 3 “contents or meaning” of a communication. Google argues that plaintiffs’ allegations of the actual 4 data sent to Google are insufficient. The complaint states that “H&R Block, TaxAct, and 5 TaxSlayer have been quietly transmitting sensitive financial information to Google when 6 Americans file their taxes online.” Compl. ¶ 32. It alleges that “H&R Block reportedly transmitted 7 information about tax filers’ filings to Google” and that both TaxAct and Tax Slayer disclosed 8 “the dollar amount of adjusted gross income and refund amounts … to Google.” Compl. ¶¶ 38–39. 9 These allegations are not as detailed as they might be, nor are they as detailed as corresponding 10 allegations in the related case against Meta. And Google correctly points out that other statements 11 in the complaint are phrased as speculation rather than allegations. See, e.g., Compl. ¶ 37 (“The 12 type of data collected by these sites may include email addresses, data on users’ income, filing 13 status, refund amounts, buttons that were clicked, and year of return.”). Still, while these 14 allegations are thinner than those in the Meta Pixel complaint, they are enough to state a claim. 15 The complaint alleges that each of the three tax filing services transmitted sensitive financial 16 information about tax filings to Google. It alleges the kinds of information that the tax filing 17 services would have been able to transmit, and it alleges the mechanism for transmission. 18 Although it does not specify exactly what information was actually transmitted by H&R Block, 19 the allegations are sufficient at the pleading stage to state a claim that the contents or meaning of 20 plaintiffs’ confidential communications were read and/or used by Google. 21 * * * 22 For the foregoing reasons, Google’s motion to dismiss Count I is denied. 23 B. Count II: California Invasion of Privacy Act ( Cal. Penal Code § 632 ) 24 Section 632 of the California Penal Code makes punishable anyone who “intentionally and 25 without the consent of all parties to a confidential communication, uses an electronic amplifying 26 or recording device to eavesdrop upon or record the confidential communication, whether the 27 communication is carried on among the parties in the presence of one another or by means of a 1 Google raises the same consent and intent arguments addressed above in moving to 2 dismiss the Section 632 claim, and they are rejected for the same reasons. 3 Google also argues that Section 632 does not apply because there is a “presumption” under 4 California law that online communications are not confidential. This view of California law 5 overreads the cases. A conversation is “confidential” under Section 632 if one of the parties has “a 6 reasonable expectation … that no one is listening in or overhearing the conversation.” Flanagan v. 7 Flanagan, 27 Cal. 4th 766 , 772–73 (2002). Although California courts applying Section 632 to 8 online communications have concluded in certain cases that communications were not 9 confidential, “California courts have never recognized a legal ‘presumption’ that internet 10 communications are not confidential under Section 632.” See Brown v. Google LLC, ––– F. Supp. 11 3d. ––––, 2023 WL 5029899 , at *18 (N.D. Cal. 2023). Further, the cases Google relies on 12 involved internet chats and emails, not sensitive financial information submitted to a tax 13 preparation website. See Campbell v. Facebook, Inc., 77 F. Supp. 3d 836 , 848–49 (N.D. Cal. 14 2014) (collecting cases). The scattering of state and federal cases (none from the California 15 Supreme Court) considering various communications on a case-by-case basis do not establish that 16 California law presumes the non-confidentiality of all online communication. But see Revitch v. 17 New Moosejaw, LLC, No. 18-CV-06827-VC, 2019 WL 5485330 , at *3 (N.D. Cal. Oct. 23, 2019) 18 (finding such a presumption). 19 In any case, the factual circumstances alleged here are clearly distinguishable from chats or 20 emails. Plaintiffs are not alleging that their communications with another person were intercepted. 21 The cases Google cites conclude that online chats and emails cannot be reasonably expected to be 22 confidential because they “can easily be shared by … the recipient(s).” See Campbell, 77 F. Supp. 23 3d at 849. But that reasoning is wholly inapplicable here. Plaintiffs instead allege that they 24 expected their tax information would remain confidential—an expectation they argue was 25 objectively reasonable because sharing tax return information without consent is a crime. At the 26 pleading stage, plaintiffs have plausibly alleged that Google intercepted communications that were 27 confidential under Section 632. Google’s motion to dismiss Count II is therefore denied. 1 C. Count III: California Invasion of Privacy Act ( Cal. Penal Code § 635 ) 2 Section 635 of the California Penal Code makes punishable anyone who “manufactures, 3 assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to 4 another any device which is primarily or exclusively designed or intended for eavesdropping upon 5 the communication of another.” Plaintiffs assert that Google Analytics is a “device … primarily or 6 exclusively designed” for eavesdropping, and that Google has therefore violated Section 635. 7 They bring a civil claim for violation of this criminal provision pursuant to Section 637.2. 8 Section 637.2 provides a right of action to “[a]ny person who has been injured by a 9 violation of this chapter ... against the person who committed the violation.” Google briefly 10 contends that Section 637.2 does not allow claims under Section 635, but the Court recently 11 rejected this argument in its Meta Pixel decision, concluding that the “better interpretation” of 12 Section 637.2 is that “injuries caused by use of an eavesdropping device are traceable to the 13 manufacture, sale, and provision of that device, and that an injured party therefore has a private 14 right of action against the creator of the device.” 2024 WL 1251350 , at *10. 15 Google next argues that Google Analytics is not designed or intended for eavesdropping. 16 Google contends that it is a vendor providing a tool to enable websites to record user interactions, 17 that such tools are commonplace, and that the vast majority of developers use Google Analytics in 18 a legitimate manner. But these are all factual responses to plaintiffs’ complaint. The complaint 19 asserts that Google Analytics is “primarily or exclusively” designed for eavesdropping. Compl. 20 ¶ 77. It alleges that the Google Analytics tracking code is “invisible” to users and is a “default 21 feature.” Compl. ¶¶ 25–27. Even without the additional configuration available to “sophisticated” 22 users, the complaint alleges that the tracking code collects detailed information about user 23 behavior by default. See Compl. ¶¶ 25–27, 35. The complaint does not suggest that the optional 24 advanced features render data collection more surreptitious. Instead, the allegations simply suggest 25 that sophisticated users can exercise greater control over the type of data collected. As the Court 26 previously explained, “at the 12(b)(6) stage the question is not whether the Court can imagine any 27 purpose … other than eavesdropping but instead whether plaintiffs’ allegations are sufficient to 1 Finally, Google repeats its argument that plaintiffs consented to the tax sites’ use of 2 Google Analytics. As before, this is a factual determination that contradicts the pleadings, which 3 the Court must take as true. This argument is therefore similarly rejected. 4 Because plaintiffs have alleged facts that state a Section 635 violation, Google’s motion to 5 dismiss Count III is denied. 6 D. Count IV: Wiretap Act ( 18 U.S.C. § 2510 , et seq.) 7 Google argues that plaintiffs’ federal Wiretap Act claim should be dismissed because 8 plaintiffs have not adequately alleged intent, because Google is merely acting as a vendor and is 9 not “intercepting” communications, and because the websites consented to data collection. The 10 intent and vendor liability arguments are the same as Google’s arguments against the California 11 Invasion of Privacy Act claims and are rejected for the same reasons. With respect to consent, 12 Google argues that because the tax sites “chose to use Google Analytics, they obviously consented 13 to it.” But this argument draws a crucial inference in Google’s favor—that in addition to installing 14 Google Analytics, website operators understood how the software works and what data would be 15 sent to Google and fully consented to that transmission. The complaint alleges that Google 16 purportedly prohibited sending personal information via Google Analytics but nevertheless 17 allowed such information to be transmitted (to its benefit). Taking this as true, the Court cannot 18 presume that every website owner who installed Google Analytics understood exactly what data 19 would be sent to Google and how Google might use it. Whether developers consented to data 20 collection by using Google Analytics is a fact dispute that cannot be resolved at this stage. 21 Accordingly, Google’s motion to dismiss Count IV is denied. 22 E. Count V: Wiretap Act ( 18 U.S.C. § 2512 ) [23] 18 U.S.C. § 2512 (1)(b) is similar to Section 635. It makes punishable any person who 24 “intentionally … manufactures, assembles, possesses, or sells any electronic, mechanical, or other 25 device, knowing or having reason to know that the design of such device renders it primarily 26 useful for the purpose of the surreptitious interception of wire, oral, or electronic communications, 27 and that such device or any component thereof has been or will be sent through the mail or 1 provides that “any person whose wire, oral, or electronic communication is intercepted, disclosed, 2 or intentionally used in violation of this chapter may in a civil action recover from the person or 3 entity, other than the United States, which engaged in that violation.” 4 Google raises the same arguments against the federal Section 2512 claim as the California 5 Section 635 claim. The consent and device-design arguments are rejected for the same reasons. 6 And as the Court has previously concluded, “Section 2520 at the very least provides a private 7 cause of action to enforce Section 2512(1)(b) against a defendant who also played an active role in 8 the unlawful interception, disclosure, or use of the plaintiff's communication.” 2024 WL 1251350 , 9 at *12. Here, as in Meta Pixel, plaintiffs allege that Google not only created Google Analytics but 10 also played an active role in its use to collect data from tax site users. See, e.g., Compl. ¶ 28. 11 Google also argues that plaintiffs have failed to plausibly allege that Google knew that 12 Google Analytics could be primarily used for a criminal purpose, as required under the federal 13 statute. But plaintiffs allege that Google furnished Google Analytics “with knowledge that it 14 would primarily be used to illegally intercept electronic communications.” Compl. ¶ 182. Google 15 argues that this allegation cannot be plausible in the face of Google’s policies purporting to require 16 that developers disclose their use of Google Analytics and obtain user consent. But this too 17 requires making factual determinations and drawing inferences in Google’s favor that go beyond 18 the pleadings and materials subject to judicial notice. Indeed, as the Court concluded in Meta 19 Pixel, “although disclosures about how [a tool] collects data might support a conclusion that 20 collection was not surreptitious, the fact that additional disclosures not inherent to the device’s 21 design are necessary to warn tracked individuals about how it works might also indicate that the 22 [tool’s] design does render it useful for surreptitious collection.” 2024 WL 1251350 , at *11. Here, 23 too, the plaintiffs’ allegations regarding knowledge and intent are sufficient at the Rule 12(b)(6) 24 stage. 25 Accordingly, Google’s motion to dismiss Count V is denied. 26 F. Count VI: Florida Security of Communications Act ( Fla. Stat. § 934.10 ) 27 The Florida Security of Communications Act provides a civil cause of action for criminal 1 which are rejected for the reasons discussed above. The motion to dismiss Count VI is denied. 2 G. Count VII: Illinois Eavesdropping Statute (720 Ill. Comp. Stat. 5/14) 3 The Illinois eavesdropping statute provides that “[a] person commits eavesdropping when 4 he or she knowingly and intentionally ... [1]ntercepts, records, or transcribes, in a surreptitious 5 |} manner, any private electronic communication to which he or she is not a party unless he or she 6 || does so with the consent of all parties to the private electronic communication.” 720 Ill. Comp. 7 Stat. 5 /14-2(a). Google’s consent, intent, and vendor-liability arguments are again rejected. Google 8 || also argues that the complaint fails to allege intentional interception “in a surreptitious manner” as 9 || required. But the complaint alleges that the Google Analytics tracking code is “invisible” and was 10 || used to “quietly transmit[]” plaintiffs’ sensitive financial information to Google. Compl. □ 25, 32. 11 This is enough to state a claim. Whether Google or the tax sites disclosed their use of Google 12 || Analytics to plaintiffs in a manner that rendered it not surreptitious is a factual issue that cannot be 13 resolved on the pleadings. The motion to dismiss Count VII is therefore denied. 14 H. Count VIII: Texas Wiretap Statute (Tex. Penal Code § 16.02) 15 Google raises the same arguments against the Texas claims as the federal wiretap claims, 16 and they are rejected for the same reasons. The motion to dismiss Count VII is therefore denied. 2 17 || V. Conclusion Z 18 For the reasons set forth above, Google’s requests for judicial notice are granted and its 19 || motion to dismiss is denied. 20 Pursuant to the parties’ stipulation, the initial case management conference is reset for June 21 27, 2024. The parties shall submit a joint case management statement by June 13, 2024. [22] 23 IT IS SO ORDERED. 24 Dated: June 3, 2024 25 Cy BQ [26] P. Casey Pitts United States District Judge