Lightoller v. JetBlue Airways Corporation

— 1 — — 2 — — 3 — — 4 — — 5 — — 6 — — 7 — — 8 — 9 UNITED STATES DISTRICT COURT 10 SOUTHERN DISTRICT OF CALIFORNIA — 11 — 12 ANNE LIGHTOLLER, individually and Case No.: 23-cv-00361-H-KSC on behalf of all others similarly situated, — 13 — ORDER GRANTING DEFENDANT’S Plaintiff, 14 MOTION TO DISMISS v. — 15 — [Doc. No. 6.] JETBLUE AIRWAYS CORPORATION, — 16 — Defendant. — 17 — — 18 — On April 25, 2023, Defendant Jetblue Airways Corporation filed a motion to dismiss — 19 — Plaintiff Anne Lightoller’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) — 20 — and 12(b)(6). (Doc. No. 6.) On May 16, 2023, Plaintiff filed a response in opposition to — 21 — Defendant’s motion to dismiss. (Doc. No. 12.) On May 23, 2023, Defendant filed a reply. — 22 — (Doc. No. 13.) — 23 — A hearing on Defendant’s motion to dismiss is currently scheduled for Monday, June — 24 — 26, 2023 at 10:30 a.m. The Court, pursuant to its discretion under Civil Local Rule — 25 — 7.1(d)(1), determines the matter is appropriate for resolution without oral argument, — 26 — submits the motion on the parties’ papers, and vacates the hearing. For the reasons below, — 27 — the Court grants Defendant’s motion to dismiss. — 28 — 1 Background 2 The following background is based on the allegations in Plaintiff’s complaint. 3 Defendant is a commercial airline that provides both national and international flights to 4 the public. (Doc. No. 1, Compl. ¶ 42.) Defendant operates the website, www.jetblue.com. 5 (Id.) Defendant procures and embeds various Session Reply Code – from third-party 6 Session Reply Providers, including FullStory – on Defendant’s website to track and 7 analyze website user interactions with the website. (Id. ¶¶ 43-44.) 8 Session Replay Code enables website operators to record, save, and replay a website 9 visitor’s interactions with a given website, including “mouse movements, clicks, 10 keystrokes (such as text being entered into an information field or text box), URLs of 11 webpages visited, and/or other electronic communications in real-time.” (Id. ¶¶ 1, 22; see 12 also id. ¶¶ 24-25.) Once the events have been recorded by a Session Replay Code, a website 13 operator can view a visual reenactment of the user’s visit through the Session Replay 14 Provider, usually in the form of a video. (Id. ¶ 27.) 15 Plaintiff visited Defendant’s website to “obtain information on flight pricing.” (Id. 16 ¶ 48.) During her visit, Plaintiff’s communications were captured by Session Replay Code 17 and sent to various Session Replay Providers. (Id. ¶ 51.) Plaintiff alleges that Defendant’s 18 conduct violates the California Invasion of Privacy Act (“CIPA”), California Penal Code 19 § 630 et. seq., and constitutes the tort of invasion of privacy rights and intrusion upon 20 seclusion. (Id. ¶ 3.) 21 On February 24, 2023, Plaintiff filed a class action complaint against Defendant, 22 alleging claims for: (1) violation of CIPA; and (2) invasion of privacy – intrusion upon 23 seclusion. (Doc. No. 1, Compl. ¶¶ 73-98.) By the present motion, Defendant moves to 24 dismiss Plaintiff’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack 25 of subject matter jurisdiction and pursuant to Federal Rule of Civil Procedure 12(b)(6) for 26 failure to state a claim. (Doc. No. 6 at 6-21.) 27 / / / 28 / / / 1 Discussion 2 Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(1) to dismiss 3 Plaintiff’s complaint for lack of subject matter jurisdiction. (Doc. No. 6 at 6-9.) 4 Specifically, Defendant argues that Plaintiff lacks standing to bring her claims because she 5 has failed to establish that she suffered an injury in fact. (See id.) 6 I. Legal Standards for a Rule 12(b)(1) Motion to Dismiss 7 Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for 8 lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial 9 or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the 10 challenger asserts that the allegations contained in a complaint are insufficient on their face 11 to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the 12 truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” 13 Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). 14 Here, Defendant’s Rule 12(b)(1) motion focuses solely on the allegations in 15 Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). (See 16 Doc. No. 6 at 6-9.) “In deciding a Rule 12(b)(1) facial attack motion, a court must assume 17 the facts alleged in the complaint to be true and construe them in the light most favorable 18 to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 1078 , 1082 19 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th 20 Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 21 F.3d 1036 , 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th Cir. 2009). 22 II. Analysis 23 Defendant argues that Plaintiff lacks Article III standing to bring her claims in this 24 action because she has failed to adequately allege that she suffered an injury in fact – 25 specifically, that she suffered a concrete harm. (Doc. No. 6 at 7-9.) In response, Plaintiff 26 asserts that she sufficiently alleges an injury in fact. (Doc. No. 12 at 5-7.) 27 Article III of the Constitution “confines the federal judicial power to the resolution 28 of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190 , 2203 1 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a 2 personal stake in the case—in other words, standing.” Id. 3 “[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” 4 Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, — 5 — 504 U.S. 555, 560 (1992)). To establish standing, “a plaintiff must show (i) that he suffered 6 an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury 7 was likely caused by the defendant; and (iii) that the injury would likely be redressed by 8 judicial relief.” TransUnion, 141 S. Ct. at 2203 (citing Lujan, 504 U.S. at 560–61). “The 9 plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these 10 elements.” Spokeo, 578 U.S. at 338 . Further, “‘[t]hat a suit may be a class action . . . adds 11 nothing to the question of standing, for even named plaintiffs who represent a class must 12 allege and show that they personally have been injured, not that injury has been suffered 13 by other, unidentified members of the class to which they belong.’” Id. at 338 n. 6 (quoting 14 Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 40, n. 20 (1976)); accord 15 Lewis v. Casey, 518 U.S. 343, 357 (1996). 16 To establish the first element of standing, “injury in fact,” “a plaintiff must show 17 that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and 18 particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 19 U.S. at 339 (citing Lujan, 504 U.S. at 560 ). “A “concrete” injury must be ‘de facto’; that 20 is, it must actually exist.” Id. at 340. A concrete injury must be “real” and not “abstract.” 21 Id. 22 “[C]ertain harms readily qualify as concrete injuries under Article III. The most 23 obvious are traditional tangible harms, such as physical harms and monetary harms.” 24 TransUnion, 141 S. Ct. at 2204 . “Various intangible harms can also be concrete.” Id.; see 25 Spokeo, 578 U.S. at 340 . “Chief among them are injuries with a close relationship to harms 26 traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for 27 example, reputational harms, disclosure of private information, and intrusion upon 28 seclusion.” TransUnion, 141 S. Ct. at 2204 . 1 Importantly, “‘Article III standing requires a concrete injury even in the context of 2 a statutory violation.’” TransUnion, 141 S. Ct. at 2205 (quoting Spokeo, 578 U.S. at 341 ). 3 The Supreme Court “has rejected the proposition that ‘a plaintiff automatically satisfies the 4 injury-in-fact requirement whenever a statute grants a person a statutory right and purports 5 to authorize that person to sue to vindicate that right.’” Id. A legislature’s creation of a 6 statutory prohibition or obligation and a cause of action does not relieve courts of their 7 responsibility to independently decide whether a plaintiff has suffered a concrete harm 8 under Article III. Id. “[U]nder Article III, an injury in law is not an injury in fact.” Id. 9 Plaintiff argues that she has adequately alleged an injury in fact as a result of 10 Defendant’s alleged violation of CIPA and her constitutional right to privacy, citing In re 11 Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020), and Licea v. Am. 12 Eagle Outfitters, Inc., No. EDCV221702MWFJPR, 2023 WL 2469630 (C.D. Cal. Mar. 7, 13 2023). (Doc. No. 12 at 5-6.) Plaintiff’s reliance on these two decisions is not persuasive. 14 In Facebook, the Ninth Circuit held that CIPA codifies “a substantive right to 15 privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.” — 16 — 956 F.3d at 598 . In Licea, the district court held “‘violations of [p]laintiffs’ statutory rights 17 under CIPA, [even] without more, constitute injury in fact because instead of a bare 18 technical violation of a statute, . . . a CIPA violation involves . . . a violation of privacy 19 rights.’” 2023 WL 2469630 , at *3 (quoting Osgood v. Main Streat Mktg., LLC, Case. No. 20 16-cv-2415-GPC (BGS), 2017 WL 131829 , at *7 (S.D. Cal. Jan. 13, 2017)). These 21 holdings are untenable in light of the Supreme Court’s holding in TransUnion that “‘Article 22 III standing requires a concrete injury even in the context of a statutory violation.’”1 141 23 S. Ct. at 2205 (“‘[W]e cannot treat an injury as “concrete” for Article III purposes based — 24 — — 25 — 1 Facebook is a pre-TransUnion case. Further, although the district court decision in — 26 — Licea was issued after TransUnion, it cites to pre-TransUnion district court cases as support 27 for its holding, and Licea does not reference, discuss, or even acknowledge TransUnion’s holding that Article III standing requires a concrete injury even in the context of a statutory — 28 — 1 only on Congress’s say-so.’ . . . [A]n injury in law is not an injury in fact.”); see also Miller 2 v. Gammie, 335 F.3d 889, 900 (9th Cir. 2003) (explaining that district courts are bound by 3 intervening Supreme Court authority and must reject any prior Ninth Circuit precent that 4 is clearly irreconcilable with that intervening authority). Under the Supreme Court’s 5 holding in TransUnion, a bare CIPA violation by itself is insufficient to demonstrate Article 6 III injury in fact. See id. Indeed, at least one district court has rejected the contention that 7 “any violation of CIPA necessarily constitutes an injury in fact without the need for an 8 additional showing of harm” on the grounds that it is at odds with the Supreme Court’s 9 holding in TransUnion. Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 10 WL 2996686 , at *3 (C.D. Cal. Apr. 5, 2023); see also, e.g., Massie v. Gen. Motors LLC, 11 No. CV 21-787-RGA, 2022 WL 534468 , at *2, 5 (D. Del. Feb. 17, 2022) (dismissing CIPA 12 claims for lack of standing on the grounds that plaintiff failed to allege a concrete injury). 13 “To be sure, the Ninth Circuit has stated that ‘violations of the right to privacy have 14 long been actionable at common law,’ and CIPA ‘codif[ies] a substantive right to privacy, 15 the violation of which gives rise to a concrete injury sufficient to confer standing.’” Byars, — 16 — 2023 WL 2996686 , at *3 (quoting Facebook, 956 F.3d at 599 ); see also Smith v. LoanMe, 17 Inc., 11 Cal. 5th 183, 191 (2021) (explaining the purpose of CIPA is “‘to protect the right 18 of privacy by, among other things, requiring that all parties consent to a recording of their 19 conversation’”). But the Ninth Circuit also explained that that right to privacy 20 encompasses an “‘individual’s control of information concerning his or her person.’” 21 Facebook, 956 F.3d at 598 (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th 22 Cir. 2017)); see U.S. Dep’t of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749 , 23 763 (1989) (“[B]oth the common law and the literal understandings of privacy encompass 24 the individual’s control of information concerning his or her person.”); see also 25 TransUnion, 141 S. Ct. at 2204 (explaining that for there to be a concrete harm, the alleged 26 injury must bear “a close relationship to harms traditionally recognized as providing a basis 27 for lawsuits in American courts,” such as “disclosure of private information” and “intrusion 28 upon seclusion”). 1 This is significant because Plaintiff’s complaint does not allege that she disclosed 2 any personal information to Defendant. Plaintiff alleges that she visited Defendant’s 3 website to “obtain information on flight pricing.” (Doc. No. 1, Compl. ¶ 48.) Plaintiff 4 alleges that while visiting Defendant’s website, her communications were monitored, 5 recorded, and collected by Defendant’s Session Replay Code. (Id. ¶¶ 49, 51-53.) Plaintiff 6 further alleges Defendant’s Session Replay Code is able to intercept and record a website 7 visitor’s electronic communications, including her “mouse movements, clicks, keystrokes 8 (such as text being entered into an information field or text box), URLs of webpages 9 visited, and/or other electronic communications in real-time.” (Id. ¶ 1; see also id. ¶¶ 22, 10 25, 27, 46.) 11 These allegations are insufficient to allege a concrete harm that bears a close 12 relationship to the substantive right of privacy (i.e., an individual’s right to control 13 information concerning his or her person). Although Plaintiff alleges that Defendant 14 monitored and recorded her communications via software when she visited Defendant’s 15 website, Plaintiff does not allege that she disclosed any personal information when she 16 visited the website. As such, no personal information was intercepted and recorded. The 17 only internet communications specifically alleged in the complaint is that Plaintiff 18 “obtain[ed] information on flight pricing.”2 (Doc. No. 1, Compl. ¶ 48; see also Doc. No. 19 12 at 2.) Flight pricing information is not personal information.3 As such, Plaintiff has — 20 — — 21 — 2 In the complaint, Plaintiff includes purported screenshots from Defendant’s website 22 in an effort to bolster her allegations, but the screenshots do not even include flight pricing information. (See Doc. No. 1, Compl. ¶¶ 52-53.) The screenshots reference an address of — 23 — “1133 Penn Avenue, Pittsburg, PA, USA.” (Id. ¶ 52.) Nowhere in the complaint does 24 Plaintiff explain what this address is or how it relates to her claims. 25 3 In the complaint, Plaintiff generally alleges: “Because most Session Replay Codes will by default indiscriminately capture the maximum range of user-initiated events and — 26 — content displayed by the website, researchers have found that a variety of highly sensitive 27 information can be captured in event responses from website visitors.” (Doc. No. 1, Compl. ¶ 28; see also Doc. No. 12 at 3.) But, importantly, Plaintiff does not allege that she — 28 — 1 failed to adequately allege that she suffered any concrete harm that bears a close 2 relationship to the right to control personal information, meaning Plaintiff has failed to 3 establish an injury in fact. See Byars, 2023 WL 2996686 , at *3 (“Plaintiff does not allege 4 that she disclosed any sensitive information to Defendant, much less identify any specific 5 personal information she disclosed that implicates a protectable privacy interest. She 6 therefore has not identified any harm to her privacy.”); Massie, 2022 WL 534468 , at *5 (“I 7 agree that Plaintiffs have a legally cognizable interest in controlling their personal 8 information and that intrusion upon that interest would amount to a concrete injury. The 9 fact of the matter remains, however, that none of Plaintiffs’ personal information is 10 implicated by the allegations they make. Plaintiffs fail to explain how either GM’s or 11 Decibel’s possession of anonymized, non-personal data regarding their browsing activities 12 on GM’s website harms their privacy interests in any way.”); see also I.C. v. Zynga, Inc., — 13 — 600 F. Supp. 3d 1034 , 1049–50 (N.D. Cal. 2022) (finding disclosure of “basic contact 14 information, including one’s email address, phone number, or . . . username” inadequate to 15 establish Article III standing based on the “insufficient fit between the loss of information 16 alleged here and the common law privacy torts of private disclosure of private facts and 17 intrusion upon seclusion”). 18 In addition, the present case is readily distinguishable from the Ninth Circuit’s 19 decision in Facebook regarding Article III standing. In Facebook, the Ninth Circuit held 20 that the plaintiffs had adequately alleged harm to their interest in controlling their personal 21 information based on the following allegations: 22 Plaintiffs alleged that Facebook continued to collect their data after they had logged off the social media platform, in order to receive and compile their — 23 — personally identifiable browsing history. As alleged in the complaint, this 24 tracking occurred “no matter how sensitive” or personal users’ browsing — 25 — — 26 — captured by Session Replay Code. See Spokeo, 578 U.S. at 338 n.6 (“‘[N[amed plaintiffs 27 who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they — 28 — 1 histories were. Facebook allegedly constantly compiled and updated its database with its users’ browsing activities, including what they did when they — 2 — were not using Facebook. According to Plaintiffs, by correlating users’ 3 browsing history with users’ personal Facebook profiles—profiles that could include a user’s employment history and political and religious affiliations— — 4 — Facebook gained a cradle-to-grave profile without users’ consent. — 5 — Here, Plaintiffs have adequately alleged that Facebook’s tracking and 6 collection practices would cause harm or a material risk of harm to their interest in controlling their personal information. As alleged, Facebook’s — 7 — tracking practices allow it to amass a great degree of personalized information. 8 Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests, and habits over a significant amount of time, without affording users — 9 — a meaningful opportunity to control or prevent the unauthorized exploration 10 of their private lives. 11 Facebook, 956 F.3d at 598–99. Facebook involved the tracking and collecting of sensitive 12 personal information. In contrast, in this case, Plaintiff does not allege that Defendant 13 recorded or collected any of her personal information. See Byars, 2023 WL 2996686 , at 14 *3 (finding the Ninth Circuit’s decision in Facebook distinguishable). 15 In sum, Plaintiff has failed to adequately allege that she suffered a concrete harm, 16 and, therefore, Plaintiff has failed to satisfy the injury in fact element for Article III 17 standing. Because Plaintiff lacks standing, the Court must dismiss Plaintiff’s claims for 18 lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th 19 Cir. 2011) (“lack of Article III standing requires dismissal for lack of subject matter 20 jurisdiction”). 21 / / / 22 / / / 23 / / / — 24 — — 25 — — 26 — — 27 — — 28 — 1 Conclusion 2 For the reasons above, the Court grants Defendant’s motion to dismiss.* The Court 3 ||dismisses Plaintiff's complaint without leave to amend for lack of subject matter 4 || jurisdiction.” See Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir. 2010) (“A 5 || district court may deny a plaintiff leave to amend if it determines that ‘allegation of other 6 consistent with the challenged pleading could not possibly cure the deficiency.”” 7 || (citation omitted)); see, e.g., Byars, 2023 WL 2996686 , at *4 (dismissing action for lack 8 ||of subject matter jurisdiction and entering final judgment). The Clerk is directed to close 9 || the case. 10 IT IS SO ORDERED. 11 || DATED: June 12, 2023 lu MARILYN HUFF, Distri ge 13 UNITED STATES DISTRICT COURT — 14 — — 15 — — 16 — — 17 — — 18 — — 19 — 0 4 It its motion to dismiss, Defendant also argues that Plaintiff's complaint should be dismissed because: (1) Plaintiffs claims are preempted by the Airline Deregulation Act, 21 U.S.C. § 41713 (b)(1) (“ADA”); (2) Plaintiff does not state a plausible claim for relief; 22 and (3) Plaintiff's consent to Defendant’s recording of her website activity bars her claims. (Doc. No. 6 at 9-21.) Because the Court grants Defendant’s motion to dismiss for the 23 reasons above, the Court declines to address these additional bases for dismissal. 24 In addition, along with its motion to dismiss, Defendant also filed a request for 5 judicial notice of certain documents. (Doc. No. 7.) In the analysis above, the Court does not reference or cite to any of the documents at issue in the request for judicial notice. As 26 such, the Court denies Defendant’s request for judicial notice as moot. 27 In her opposition to Defendant’s motion to dismiss, Plaintiff did not request leave to 28 amend her complaint nor did Plaintiff assert that she could allege any additional facts that would cure the defects in Article II standing.