Opinion
No. 11-MD-02264 JSW
03-10-2014
IN RE GOOGLE ANDROID CONSUMER PRIVACY LITIGATION THIS DOCUMENT APPLIES TO ALL CASES
NOT FOR PUBLICATION
ORDER GRANTING, IN PART,
AND DENYING, IN PART,
MOTION TO DISMISS SECOND
AMENDED COMPLAINT AND
SETTING CASE MANAGEMENT
CONFERENCE
(Docket No. 62)
This matter comes before the Court upon consideration of the motion to dismiss filed by Defendant Google, Inc. ("Google"). The Court has considered the parties' papers, relevant legal authority, and the record in this case, and it HEREBY GRANTS, IN PART, AND DENIES, IN PART, Google's motion to dismiss.
BACKGROUND
A more detailed account of the facts underlying this dispute is set forth in the Court's Order granting in part and denying in part the motion to dismiss the First Amended Class Action Complaint. In re Google Android Consumer Privacy Litig., 2013 WL 1283236, at *1-*2 (N.D. Cal. Mar. 26, 2013) ("In re Google").
Plaintiffs, Kendrick Cochran ("Mr. Cochran"), Nicholas Lawrence ("Mr. Lawrence"), Beverly Julia Levine Hillman-Seidner ("Ms. Hillman-Seidner"), Joan Smith ("Ms. Smith"), Phillip Hall ("Mr. Hall"), and Maritsa Urias ("Ms. Urias") (collectively "Plaintiffs") allege that Google "gained and allowed third parties to have unauthorized access to, and engaged in unauthorized use of," their mobile devices, which use Google's Android Operating System ("AOS"). (Docket No. 54, Second Amended Consolidated Class Action Complaint ("SACC"), ¶ 2; see also id. ¶¶ 35-46.)
According to Plaintiffs, they each installed one or more of the following software applications ("Apps") on their Android mobile devices: Foursquare; Groupon; Advanced Task Killer; Angry Birds; and Pandora. Plaintiffs allege that these Apps "collected personal data from their Android Mobile Phones and shared this data with" Google. (Id. ¶¶ 4, 78-87.) Plaintiffs contend that they were unaware of and did not knowingly consent to collection of this data, which included
Class Members' home and workplace locations and current whereabouts; several universally unique device identifiers ("UUIDs") assigned to Plaintiffs' Android mobile phones; other device-specific data that was useful to Google and third parties for purposes of "device-fingerprinting;" (i.e., the creation of a back-up unique identifier to engage in tracking of a particular device); along with personal information about Plaintiffs such as their gender and age, what functions Plaintiffs performed on Apps, search terms entered, and selections of movies, songs, or restaurants.(Id. ¶¶ 7-8; see also id. ¶¶ 70-77.)
Plaintiffs allege that although Google claimed users could "opt-in" to location tracking, Google actually continually stored their location data, which was transmitted to Google the next time location services were turned on. (Id. ¶ 73.) Plaintiffs also allege that "Google falsely claims that once users opt-in, they will be 'anonymized'," because, in truth, "any location data that is sent back to Google location servers is tied and/or traceable to a specific user through the use of UUID's." (Id. ¶ 73; see also id. ¶ 30.) Plaintiffs also assert that Google made a number of misrepresentations about the fact that "their personal information would be kept secure," which led Plaintiffs to believe that Google would not collect and share "their personal information, including their phone use habits and their location." (Id. ¶¶ 106-115.)
According to Plaintiffs, "this surreptitious use of resources had a real cost to Plaintiffs ... through the consumption and use of battery life, bandwidth, and file storage of their Android Mobile Phones," and they contend that Google "potentially" exposed them to data overage charges. (Id. ¶¶ 9-14, 98-105.) Plaintiffs also allege that they paid more for their Android Mobile Phones than they would have paid if they had known Google tracked and shared their personal data. (Id. ¶ 13.)
Based on these and other allegations, which the Court shall address as necessary, Plaintiffs bring claims for violations of the Computer Fraud and Abuse Act, 18 U.S.C. section 1030 (the "CFFA Claim") and violations of California's Unfair Competition Law, California Business and Professions Code sections 17200, et seq. (the "UCL Claim").
ANALYSIS
A. Applicable Legal Standards.
1. Federal Rule of Civil Procedure 12(b)(1) ("Rule 12(b)(1)").
Google moves to dismiss on the basis that Plaintiffs lack standing under Article III of the United States Constitution. The Court evaluates the motion to dismiss for lack of Article III standing pursuant to Rule 12(b)(1). See White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). A motion to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1) may be "facial or factual." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). In this case, Google raises a facial challenge to Plaintiffs' standing, and, therefore, the Court "must accept as true all material allegations in the complaint, and must construe the complaint in" Plaintiffs' favor. Chandler v. State Farm Mut. Auto Ins. Co., 598 F.3d 1115, 1121-22 (9th Cir. 2010); see also Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) ("At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion dismiss, [courts] presume that general allegations embrace those specific facts that are necessary to support the claim.") (internal cite and quotations omitted).
"The jurisdictional question of standing precedes, and does not require, analysis of the merits." Equity Lifestyle Props., Inc. v. County of San Luis Obispo, 548 F.3d 1184, 1189 n.10 (9th Cir. 2008). Thus, the fact that Plaintiffs may allege facts that, at the pleading stage, satisfy the requirements for Article III standing does not mean these same facts would be sufficient to state a claim. See Doe v. Chao, 540 U.S. 614, 624-25 (2004); In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 712 n.5 (N.D. Cal. 2011) (quoting Doe, 540 U.S. at 624-25).
2. Federal Rule of Civil Procedure 12(b)(6) ("Rule 12(b)(6)").
Google also moves to dismiss each of Plaintiffs' claims pursuant to Rule 12(b)(6). A motion to dismiss is proper under Rule 12(b)(6) where the pleadings fail to state a claim upon which relief can be granted. In addition, "lack of statutory standing requires dismissal for failure to state a claim[.]" Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). On a motion to dismiss under Rule 12(b)(6), the Court construes the allegations in the complaint in the light most favorable to the non-moving party and takes as true all material allegations in the complaint. Sanders v. Kennedy, 794 F.2d 478, 481 (9th Cir. 1986).
Even under the liberal pleading standard of Rule 8(a)(2), "a plaintiff's obligation to provide the 'grounds' of his 'entitle[ment] to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). Rather, a plaintiff must instead allege "enough facts to state a claim to relief that is plausible on its face." Id. at 570. "The plausibility standard is not akin to a probability requirement, but it asks for more than a sheer possibility that a defendant has acted unlawfully.... When a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief." Ashcroft v. Iqbal, 556 U.S.662, 678 (2009) (quoting Twombly, 550 U.S. at 557) (internal quotation marks omitted).
If a plaintiff's allegations are insufficient to state a claim, a court should grant leave to amend, unless amendment would be futile. See, e.g., Reddy v. Litton Indus., Inc., 912 F.2d 291, 296 (9th Cir. 1990); Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv., Inc., 911 F.2d 242, 246-47 (9th Cir. 1990).
B. The Court Denies Plaintiffs' Motion to Strike.
In support of its motion, Google submitted a declaration from Michael H. Rubin, to which it has attached the following exhibits: (1) the Google Privacy Policy dated October 20, 2011; (2) the Android Market Developer Distribution Agreement; (3) and privacy policies and permissions tabs for the Angry Birds, Foursquare, Groupon, Pandora, and Advanced Task Killer Apps. (Docket No. 63.) Plaintiffs move to strike the declaration and the exhibits in their entirety.
Under the "incorporation by reference" doctrine, courts may consider documents that are "referenced extensively in the complaint and [are] accepted by all parties as authentic," even if they are not attached to the complaint. Van Buskirk v. Cable News Network, Inc., 284 F.3d 977, 980 (9th Cir. 2002). The Court denies the motion to strike Exhibit A, which is Google's Privacy Policy. Plaintiffs quote from that document in the SACC, rely on it to support their claims, and have not disputed its authenticity.
Because the Court did not rely on any of the other exhibits to resolve the motion, the Court denies, as moot, the motion to strike these exhibits.
C. The Court Denies the Motion to Dismiss for Lack of Article III Standing.
In order to satisfy Article III's standing requirements, Plaintiffs must show: (1) they suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) that the injury is fairly traceable to Google's conduct; and (3) that it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Lujan, 504 U.S. at 560-61.
Plaintiffs argue that they have Article III standing based on, inter alia, the increased rate at which their batteries discharge, which impaired the performance of their phones. The Court previously concluded that these allegations were sufficient to establish Article III standing against Google. See In re Google, 2013 WL 1283236, at *5. Google argues that the Court should revisit this ruling. Google may not have manufactured Plaintiffs' mobile devices, and Plaintiffs may face an uphill battle proving this theory of standing. they have alleged sufficient facts to show that they suffered an injury, the injury is fairly traceable to Google's conduct, and the injury could be redressed by the relief Plaintiffs seek.
See, e.g., In re iPhone App. Litig., - F. Supp. 2d -, 2013 WL 6212591 (N.D. Cal. Nov. 25, 2013).
Accordingly, the Court denies, in part, Google's motion to dismiss.
Because the Court concludes that these facts are sufficient to allege Article III standing, it does not address Plaintiffs alternative theories of standing in this section. The Court shall address those alternative theories, as necessary, in its analysis of the CFAA and UCL claims.
D. The Court Grants Google's Motion to Dismiss the CFAA Claim.
In their first claim for relief, Plaintiffs assert that Google violated the CFAA. "The CFAA prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1131 (9th Cir. 2009); see also 18 U.S.C. § 1030(a)(1)-(7).
In order to bring a civil action under the CFAA, Plaintiffs must be able to show a damage or loss "to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value." 18 U.S.C. § 1030 (c)(4)(A)(i)(I), (g). The CFAA defines "damage" as "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). The CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11).
Google argues that Plaintiffs' allegations are insufficient to show the requisite damage or loss. Plaintiffs rely on the same factual allegations that purport to show Article III standing to support the "damage" and "loss" elements of the CFAA Claim. (See SACC ¶¶ 137, 147, 149.) For example, Plaintiffs rely on allegations that Google's conduct diminished the value of their PII and, as a result, they suffered loss. (SACC ¶ 149.) For the reasons set forth in its Order granting in part and denying in part Google's motion to dismiss the First Amended Class Action Complaint, the Court concludes that these allegations still are insufficient to establish damage or loss under the CFAA. See In re Google, 2013 WL 1283236, at *4, *7-*8.
Plaintiffs also rely on the allegations regarding diminished battery life, and they claim they have sufficiently alleged damage and loss, because their service was interrupted as a result of Google's conduct. Plaintiffs contend these allegations distinguish this case from In re iPhone App. Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012) ("iPhone App. Litig. II"). In that case, the court found that plaintiffs had not included facts to suggest the defendant's conduct "impaired" their devices or interrupted service and, thus, failed to show damage or loss under the CFAA. See id., 844 F. Supp. 2d at 1067. Here, Plaintiffs do allege that Google's conduct interrupted their service. That fact might be sufficient to satisfy the definition of "damage" set forth in 18 U.S.C. section 1030(e)(8). However, in order to pursue a civil action under the CFAA, Plaintiffs also must show economic damage or loss in the amount $5,000. 18 U.S.C. § 1030 (c)(4)(A)(i)(I). Plaintiffs allege that a new battery could cost $70.00. However, none of the Plaintiffs allege that they did purchase new batteries because of Google's conduct. (See, e.g., SACC ¶¶ 98-102.) The Court concludes that the allegations regarding diminished battery life still are insufficient to allege that the economic damage or loss - even if aggregated - would reach the $5,000 threshold required by the CFAA.
Finally, Plaintiffs rely on allegations that they paid for their data plans, and that Google "used or allowed the use of a finite amount of" their data plans. Again, none of the named Plaintiffs alleged that they incurred any overage charges. Rather, they only allege that they were "potentially" exposed to overage charges. (SACC ¶¶ 103-105.) The Court concludes that the allegations regarding "loss" based on "Data Plan Utilization" are insufficient to allege that the economic damage or loss - even if aggregated - would reach the $5,000 threshold required by the CFAA. See, e.g., iPhone App. Litig. II, 844 F. Supp. 2d at 1067.
That fact distinguishes this case from the facts in the related case Yunker v. Pandora Media, 13-CV-3113-JSW.
--------
Accordingly, the Court grants Google's motion to dismiss the CFAA Claim. This is Plaintiffs' third iteration of the complaint, and the Court concludes that any further attempts to amend this claim would be futile.
E. The Court Grants, in Part, and Denies, in Part, Google's Motion to Dismiss the UCL Claim.
Plaintiff's second claim for relief is a claim under the UCL, which prohibits "three varieties of unfair competition: practices which are unlawful, unfair or fraudulent." Daugherty v. American Honda Motor Co., 144 Cal. App. 4th 824, 837 (2006); see also Albillo v. Intermodal Container Services, Inc., 114 Cal. App. 4th 190, 206 (2003) (to state a UCL claim, a "plaintiff must establish that the practice is either unlawful (i.e., is forbidden by law), unfair (i.e., harm to victim outweighs any benefit) or fraudulent (i.e., is likely to deceive members of the public)").
The UCL also "requires that a plaintiff have 'lost money or property' to have standing to sue. The plain import of this is that a plaintiff now must demonstrate some form of economic injury." Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 323 (2011); see also Cal. Bus. & Prof. Code § 17204. "California courts have distinguished the UCL standing requirement as more stringent than the federal Article III standing requirement," because of the requirement that a UCL plaintiff have lost money or property. Pirozzi v. Apple, Inc., - F. Supp. 2d -, 2013 WL 4029067, at *5 (N.D. Cal. Aug. 5, 2013). However, there are many ways a plaintiff may establish economic injury to show standing under the UCL, including "surrender[ing] in a transaction more, or acquir[ing] in a transaction less, than he or she otherwise would have." Kwikset, 51 Cal. 4th at 323; see also id. at 325 (allegations of "personal, individualized loss of money or property in any nontrivial amount" is sufficient to allege injury in fact under UCL).
Google moves to dismiss this claim for lack of statutory standing, and it also argues that Plaintiffs fail to allege facts that show Google violated the UCL.
1. Plaintiffs Have Statutory Standing to Pursue the UCL Claim.
Plaintiffs contend they have standing under the UCL based on the allegations that they "paid more than they otherwise would have for their phones, lost available data on their data plans, and suffered diminished battery life." (SACC ¶ 156.) For the reasons set forth in its previous Order, the Court concludes that Plaintiffs have alleged sufficient facts to show standing based on the diminished battery life. See In re Google, 2013 WL 1283236, at *8; see also Goodman v. HTC America, Inc., 2012 WL 2412070, at *12 (W.D. Wash. June 26, 2012).
Accordingly, the Court denies, in part, Google's motion to dismiss.
2. Plaintiffs Fail to State a Claim Under the Unlawful Prong.
To state a claim based on the unlawful prong, Plaintiffs must allege that the Google Defendants' practices are "forbidden by law, be it civil, criminal, federal, state, or municipal, statutory, regulatory, or court made." Saunders v. Superior Court, 27 Cal. App. 4th 832, 838-39 (1994). "[A] violation of another law is a predicate for stating a cause of action" under the unlawful prong. See Berryman v. Merit Property Mgmt., Inc., 152 Cal. App 4th 1544, 1554 (2007).
Plaintiffs fail to allege facts showing a violation of the CFAA, and they do not identify any other statutes that could support a claim under the unlawful prong. Plaintiffs also have not provided the Court with any authority that the alleged violations of the settlement described in paragraph 20 of the SACC could support this claim.
Accordingly, Plaintiffs fail to state a claim under the unlawful prong, and the Court grants, in part, Google's motion to dismiss.
3. Plaintiffs State a Claim Under the Unfair Prong.
Google also argues that Plaintiffs fail to state a claim under the unfair prong. Unfair simply means any practice whose harm to the victim outweighs any benefits. Olsen v. Breeze, Inc., 48 Cal. App. 4th 608, 618 (1996). "The court must weigh the utility of the defendant's conduct against the gravity of the harm to the alleged victim." Gafcon, Inc. v. Ponsor & Assocs., 98 Cal. App. 4th 1388, 1425 n.15 (2002). In iPhone App. Litig. II, the court found that allegations regarding collection and dissemination of personal information, which are similar to Plaintiffs' allegations, were sufficient to state a claim under the unfair prong. iPhone App. Litig. II, 844 F. Supp. 2d at 1073.
In its previous order, the Court found that Plaintiffs had alleged UCL standing for their claims against Google. It also stated that Plaintiffs could state a claim under this prong, if they were able to allege standing. Because Google is the only remaining defendant, Plaintiffs state a claim under the unfair prong.
Accordingly, the Court denies, in part, Google's motion to dismiss.
4. Plaintiffs State a Claim Under the Fraudulent Prong.
Plaintiffs also assert that the Google's conduct violates the fraudulent prong of the UCL. (See SACC ¶¶ 162-167.) To state a cause of action under the fraudulent prong of Section 17200, it is necessary only to show members of the public are likely to be deceived; allegations that the fraudulent deception was "actually false, known to be false by the perpetrator and reasonably relied upon by a victim who incurs damages" are not necessary. In re Tobacco II Cases, 46 Cal. 4th 298, 312 (2009).
Google argues that, although Plaintiffs have alleged the purportedly false statements with specificity, they still fail to allege facts showing why the statements were false. It also argues that Plaintiffs' allegations are directly contradicted by the terms of its Privacy Policy. The Court finds that Plaintiffs' allegations are similar to the allegations in iPhone App. Litig. II. Specifically, Plaintiffs contend that Google's representations that users can opt-in to location monitoring is false, because Google continues to track and store information even when the location services feature is turned off. Cf. iPhone App. Litig. II, 844 F. Supp. 2d at 1074.
In addition, the plaintiffs allege that contrary to the representations in Google's privacy policy, Google designed the AOS "to enable and promote the taking of Plaintiffs ... personal information so as to further monetize, for [Google's] benefit, the advertising potential of AOS-based devices and to advance Google's revenue model in the wireless/mobile marketplace." (SACC ¶ 3; see also id. ¶ 4 (alleging that Google collected and transmitted PII "for purposes wholly unrelated to the use and functionality of" an Android mobile device or App). These allegations are similar to the allegations made by the "iDevice Class" in iPhone App. Litig. II. See 844 F. Supp. 2d at 1074.
The Court concludes that these allegations, in combination with the allegations that Plaintiffs relied on these statements and paid more for their mobile devices than they otherwise would have are sufficient to allege a claim under the fraudulent prong.
Accordingly, the Court denies, in part, Google's motion to dismiss.
4. The Court denies Google's motion to dismiss the claim for restitution.
Google also moves to dismiss Plaintiffs' claim for restitution under the UCL on the basis that, because Plaintiffs did not pay any money to Google, they are asking for "non-restitutionary disgorgement," which is not an available remedy under the UCL. Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1145 (2003). In Ferrington v. McAfee, the district court rejected a similar argument, and stated that the "distinction California courts have drawn between restitutionary disgorgement and non-restitutionary disgorgement does not turn on whether Plaintiffs paid money directly to the defendant. It turns, rather, on whether the profits sought to be disgorged would merely 'restore the status quo by returning to the plaintiff funds in which she has an ownership interest' or would achieve something broader." Id., 2010 WL 3910169, at *9 (N.D. Cal. Oct. 5, 2010) (quoting In re First Alliance Mortgage Co., 471 F.3d 977, 996 (9th Cir. 2006)).
Although Plaintiffs do not allege facts that show they paid money directly to Google, the Court cannot conclude that Plaintiffs might not be able to show an ownership interest in at least some of Google's profits. Cf. Colgan v. Leatherman Tool Group, Inc., 135 Cal. App. 4th 663, 699 (2006) (a plaintiff can seek money or property as restitution where such "money or property identified as belonging in good conscience to the plaintiff could clearly be traced to particular funds or property in the defendant's possession") (citation omitted).
Accordingly, the Court denies, in part, Google's motion to dismiss. However, the Court shall not preclude Google from renewing this argument as this case progresses.
5. The Court denies the motion to dismiss the non-California plaintiffs.
Google also moves to dismiss the UCL claims brought by Mr. Lawrence, Ms. Hillman-Seidner, Ms. Smith, Mr. Hall, and Ms. Urias, on the basis that they are not California residents. In support of this argument, Google relies on Mazza v. American Honda Motor Co., 666 F.3d 581 (9th Cir. 2012) and Frezza v. Google, Inc., 2013 WL 1736788 (N.D. Cal. Apr. 22, 2013). In Mazza, the defendant was headquartered in California, and the plaintiffs alleged that the allegedly fraudulent misrepresentations emanated from California. However, the transactions that purportedly injured class members took place outside California. Mazza, 660 F.3d at 590. The Ninth Circuit reversed the district court's decision to certify a nationwide class for alleged violations of the UCL, and it held that "[u]nder the facts and circumstances of this case, we hold that each class member's consumer protection claim should be governed by the consumer protection laws of the jurisdiction in which the transaction took place." Id. at 594.
Plaintiffs argue that the Mazza argument is premature and should be addressed at the class certification phase. In the Frezza case, the district court rejected a similar argument, and found that the choice-of-law principle announced in Mazza "applies generally and is instructive even when addressing a motion to dismiss." Frezza, 2013 WL 1736788, at *6; see also id., at *5 ("The factual analogy makes Mazza's application of the choice-of-law rule to the facts of this case, not only relevant but controlling."). However, in both Mazza and Frezza, the courts engaged in a choice-of-law analysis to determine which state's law should apply.
Google raised this argument in a footnote, and it presents no argument as to why Texas and Alabama law would conflict with California law. Accordingly, the Court concludes that Google has not met its burden to show the claims of non-California plaintiffs should be dismissed. This ruling is without prejudice to Google renewing this argument in a subsequent motion.
CONCLUSION
For the foregoing reasons, the Court grants, in part, and denies, in part, Google's motion to dismiss. The Court ORDERS the parties to appear for a case management conference on April 18, 2014 at 11:00 a.m., in Courtroom 5, Second Floor, 1301 Clay Street, Oakland, California. The parties' joint case management statement shall be due by no later than April 11, 2014.
IT IS SO ORDERED.
__________________________
JEFFREY S. WHITE
UNITED STATES DISTRICT JUDGE