Summary
In Kauffman, the court acknowledged that the plain language of the first clause requires the plaintiff to “allege facts plausibly showing that [the defendant] or its vendor made an unauthorized connection with a ‘telegraph or telephone wire, line, cable, or instrument.'” Id.
Summary of this case from Ramos v. The Gap, Inc.Opinion
22-cv-1492-L-MSB
01-12-2024
DAVID KAUFFMAN, et al., Plaintiff, v. PAPA JOHN'S INTERNATIONAL, INC., Defendant.
ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS [ECF NO. 30 ]
Hon. M. James Lorenz United States District Judge
Pending before the Court in this putative class action asserting violations of the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code §§ 631 and 632.7, is Defendant Papa John's International's Motion to Dismiss. [ECF No. 30.] The Court decides the matter on the papers submitted and without oral argument. See Civ. L. R. 7.1(d.1). For the reasons stated below, the Court grants in part and denies in part the Motion to Dismiss.
The facts are taken from the Second Amended Complaint.
Defendant owns and operates the following website: www.papajohns.com. Over the past year, David Kauffman (“Plaintiff”) and Class Members visited Defendant's website from cell phones and other mobile devices to purchase pizzas. Plaintiff and Class Members were in California during each visit to Defendant's website. Plaintiff used Defendant's mobile website to order pizza sold by Defendant from its location at 4089 Genesee Avenue, San Diego, California. Plaintiff placed the order(s) by entering information on Defendant's website, customizing his order, adding the order to his cart, and making payment by entering his credit card information to complete his purchase.
Defendant and FullStory used session replay software which enabled it to see the screens of Plaintiff and Class Members while they were on Defendant's website. The “sessions” were recorded and shared with or by FullStory. Defendant installed FullStory's session replay onto its servers and inserted the JavaScript into the HTML code of its website. When consumers visit Defendant's website, the JavaScript immediately loads onto their device, from Defendant's site, and is stored in their device's cache or temporary internet files. As soon as Defendant's site loaded on Plaintiff's cell phone, Plaintiff's phone began sending and receiving electronic communications in the form of instructions to and from Defendant's computer servers utilized to operate its website. The commands were sent as messages indicating to Defendant what words and text were typed, credit card number, CVV, billing zip code, first name, last name, phone number, address, email address, any search terms entered, and what content was being clicked, requested, and inputted by Plaintiff including what food he was ordering to be delivered to his home in California from the Genesee Avenue Papa John's location.
II. PROCEDURAL BACKGROUND
On October 3, 2022, Plaintiff filed a Complaint asserting violations of the Federal Wiretap Act, 18 U.S.C. §2510 et seq (the “Wiretap Act”) and the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code § 631, in relation to the unauthorized interception, collection, recording, and dissemination of Plaintiff's and Class Members' communications and data. [ECF No. 1.] On January 26, 2023, Plaintiffs filed a First Amended Complaint asserting violations of the Federal Wiretap Act, 18 U.S.C. §2510 et seq and CIPA, Cal. Pen. Code §§ 631 and 632. [ECF No. 22.] On April 10, 2023, Plaintiffs filed a Second Amended Complaint asserting violations of CIPA, Cal. Pen. Code §§ 631 and 632.7. [ECF No. 29.]
On April 24, 2023, Defendant filed the present Motion to Dismiss. (Motion [ECF No. 30.]) On May 8, 2023, Plaintiffs filed a response in opposition. (Opposition [ECF No. 31.]) On May 15, 2023, Defendants filed a Reply. [ECF No. 32.])
III. DISCUSSION
Defendant seeks dismissal of this action for lack of personal jurisdiction and failure to state a claim.
A. Personal Jurisdiction
Where a defendant moves to dismiss for lack of personal jurisdiction, it “is the plaintiff's burden to establish the court's personal jurisdiction over a defendant.” Doe v. Unocal, 248 F.3d 915, 922 (9th Cir. 2001)(abrogated on other grounds) (citing Cubbage v. Merchent, 744 F.2d 665, 667 (9th Cir. 1984), cert. denied 470 U.S. 1005 (1985)). To withstand a motion to dismiss under Fed.R.Civ.P. 12(b)(2), the plaintiff need only demonstrate facts that if true, would support jurisdiction over the defendant. Id. Although the plaintiff cannot “simply rest on the bare allegations of the complaint,” uncontroverted allegations contained in the complaint must be taken as true. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004).
A district court has personal jurisdiction over a defendant only if a statute authorizes jurisdiction and the assertion of jurisdiction does not offend due process. Unocal, 248 F.3d at 922. “Where . . . there is no applicable federal statute governing personal jurisdiction, the district court applies the law of the state in which the district court sits.” Yahoo! Inc., v. La Ligue Contre Le Racisme Et L'Antisemitisme, 433 F.3d 1199, 1205 (9th Cir. 2006); see also Fed.R.Civ.P. 4(k)(1)(a). Because California's long-arm statute is coextensive with federal due-process requirements, the jurisdictional analyses under state and federal law are the same. Yahoo!, Inc., 433 F.3d at 1205; Cal. Civ. Proc. Code § 410.10.
Absent traditional bases for personal jurisdiction (i.e. physical presence, domicile, and consent), the Due Process Clause requires that a nonresident defendant have certain minimum contacts with the forum state such that the exercise of personal jurisdiction does not offend traditional notions of fair play and substantial justice. Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945). Depending upon the level of contacts with the forum state, personal jurisdiction can be “general” or “specific”. See Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 n. 8 (1984). A court may assert general personal jurisdiction over a corporation "when their affiliations with the State are so 'continuous and systematic' as to render them essentially at home in the forum State." Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011). “[I]n the paradigmatic circumstance for exercising general jurisdiction, the corporate defendant is incorporated or has its principal place of business in the forum state.” Williams v. Yamaha Motor Co., 851 F.3d1015, 1020 (9th Cir. 2017). The Second Amended Complaint implicates only specific, not general jurisdiction because Papa John's is a Delaware corporation with its principal place of business in Kentucky. See Williams, 851 F.3d at 1020.
For specific jurisdiction to apply:
(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
(2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and
(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.Schwarzenegger, 374 F.3d at 802.
Plaintiff bears the burden of satisfying the first two prongs of the test. Id. If plaintiff succeeds in satisfying both prongs, the burden shifts to the defendant to present a “compelling case” that the exercise of jurisdiction would not be reasonable. Id. “If the plaintiff fails to satisfy either of these prongs, personal jurisdiction is not established in the forum state.” Id.
1. Purposeful Availment/Direction
The phrase “purposeful availment” includes both purposeful availment, which is most often used in contract suits, and purposeful direction, which is most often used in tort causes of action such as the present claims. Schwarzenegger, 674 F.3d at 802. “A showing that a defendant purposefully directed his conduct toward a forum state . . . usually consists of evidence of the defendant's actions outside the forum state that are directed at the forum, such as the distribution in the forum state of goods originating elsewhere.” Id. at 803. Purposeful direction is evaluated under the three-part “effects” test originating with Calder v. Jones, 465 U.S. 783 (1984). Id. Under Calder, the defendant must “have 1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Dole Foods Co., Inc., v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002).
According to Defendant, Plaintiff fails to show that Papa John's “operation of a nationally accessible website and its alleged use of session replay technology on that website” are expressly aimed at California or distinguish California from other states where the website is accessible. (Mot. at 6). In addition, Defendant contends that the automatic location services on Papa John's website and California-specific provisions in the Privacy Statement do not indicate that Papa John's specifically aimed its conduct at California residents. (Id. at 7). According to Defendant, the complaint lacks allegations that show any of Papa John's acts were more likely to cause harm in California than any other forum. (Id. at 8).
Plaintiff counters that all three of the “purposeful direction” elements are satisfied here: (1) Defendant committed an intentional act by operating numerous restaurants in conjunction with its website to sell pizza to individuals in California and imbedded the website with session replay code; (2) Defendant expressly aimed conduct at California by using a website that was integrated with the operation of retail outlets and franchises; and (3) Defendant knew that harm was likely to be suffered in California by the collection of personal data via FullStory's session replay code. (Oppo. at 6-8).
Plaintiff has satisfied the first element because the Complaint sufficiently alleges that Defendant committed an intentional act by operating restaurants in California from which customers purchase food via the website, and that Papa John's intentionally embedded the website with session replay technology See Schwarzenegger, 374 F.3d at 806 (For purposes of Calder test, “intent” is construed as “an intent to perform an actual, physical act in the real world, rather than an intent to accomplish a result or consequence of that act.”)
Turning to the “express aiming” prong, “[n]ot all material placed on the Internet is, solely by virtue of its universal accessibility, expressly aimed at every state in which it is accessed.” Mavrix Photo, Inc. v. Brand Technologies, Inc., 647 F.3d 1218, 1231 (9th Cir. 2011). While the operation of “a passive website alone cannot satisfy the express aiming prong,” the operation of a website in conjunction with “something more” including the “interactivity of the defendant's website [and] the geographic scope of the defendant's commercial ambitions” can satisfy this prong. Id. at 1229. It is undisputed that Defendant operates the interactive website www.papajohns.com, that allows California users to peruse menus, place orders, and pay for food from Papa John retail stores as part of its regular course of business. The Complaint claims that “Defendant chose to benefit from marketing and doing business in California” and cites to the website to illustrate that California residents were targeted by Defendant. (SAC at ¶¶ 33, 41 n. 7). The landing page notes “Menu, Special Offers and Pricing may vary for each Papa Johns location.”Papa John's website https://www.papajohns.com/order/stores-near-me (last visited January 8, 2024). Plaintiff also claims that Defendant “included California-specific provisions in its Privacy Statement in recognition that California citizens would be using Defendant's website” which subjects Defendant to California law. (SAC ¶ 35).
“A court may ... consider certain materials-documents attached to the complaint, documents incorporated by reference in the complaint, or matters of judicial notice-without converting the motion to dismiss into a motion for summary judgment.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003).
These assertions sufficiently allege that Defendant operates an interactive website which is integrated with retail outlets in California, therefore Papa John's is carrying on part of its general business in California by marshaling the market via its website. This satisfies the “something more” requirement to demonstrate that Defendant “expressly aimed” its conduct at California. See Mavrix, 647 F.3d at 1231 (“where, as here, a website with national viewership and scope appeals to, and profits from, an audience in a particular state, the site's operators can be said to have ‘expressly aimed' at that state.”)
The final element requires Plaintiff to show that Papa John's was aware that the alleged harm was likely to be suffered in California. To show that Papa John's knew its conduct was likely to cause harm in California, Plaintiff must show that Papa John's knew of his connection to California. See generally, Bergstein v. Parmar, 2014 WL 12586073, at * 3-4 (C.D. Cal. June 23, 2014)(Plaintiff satisfied third element where defendant was aware that plaintiff “lived and worked in California” and that plaintiff suffered harm in California as a result of defendant's conduct.) In the Complaint, Plaintiff asserts that Defendant knew the harm caused by the session replay recording would be suffered by Californians because
[m]any Californians purchase items on Defendant's site and enter their California addresses. Another way Defendant knows a consumer is located in California is through location-determining tools that track and analyze users' IP addresses, without requiring the user to manually input a physical address. The employment of automatic location services in this way means that Defendant is continuously aware that its website is being visited by people located in California to buy Defendant's products in California, and that such website visitors are being tapped and recorded in violation of California statutory law, causing privacy harm to California citizens.(SAC ¶ 34). Defendant claims that auto-location functionalities are insufficient to meet Plaintiff's burden under AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1211 (9th Cir. 2020), but the issue in AMA was “geo-located advertisements” which did not operate in the same manner as the Papa John's session replay technology which employs geo-tracking to target specials to California residents and find the nearest restaurant for delivery purposes. Accordingly, the Court finds that Plaintiff has sufficiently alleged for purposes of this motion that California residents were the focal point of Papa John's target marketing via its website and that they knew Californians would suffer the alleged harm.
2. Arise out of or Relate to Defendant's Conduct
The Ninth Circuit distinguishes between “passive” and “interactive” websites when determining whether a claim arises out of a Defendant's operation of a nationally accessible internet cite. See Cybersell, Inc., v. Cybersell, Inc., 130 F.3d 414, 418 (9th Cir. 1997). “Courts that have addressed interactive sites have looked to the ‘level of interactivity and commercial nature of the exchange of information that occurs on the Web site' to determine if sufficient contacts exist to warrant the exercise of jurisdiction.” Id.
Defendant claims that Plaintiff has failed to establish that his claims arise out of or relate to Papa John's contacts with the forum because the complaint lacks any factual detail specifically linking Plaintiff's claim to California, except for the allegation that Plaintiff chose to access the website from within California. (Mot. at 9). Instead, Defendant argues that the “relevant conduct” is Papa John's operation of a nationally accessible website and alleged use of session replay technology on that website but that conduct did not occur within California and is therefore insufficient to authorize jurisdiction. (Id.)
In response, Plaintiff contends that Defendant uses its website to systematically serve the California market by directing “California customers to its numerous restaurants in the state and offers specific menus and offers to California residents” which forms the basis for specific jurisdiction under Ford Motor Company v. Montana Eighth Judicial District Court, 141 S.Ct. 1017, 1026 (2021). (Oppo. at 9).
Plaintiff has alleged facts demonstrating that Defendant's website is interactive because it allows customers to obtain information about Defendant's menu, order products, and receive delivery of those products in California at a restaurant closest to the customer's location. In the Complaint, Plaintiff asserts that Defendant directed “purposeful and tortious acts toward the citizens of California” by doing business and engaging in commercial activity with California citizens via the website which was viewing and collecting information from California residents. (SAC at ¶ 33). Under Cybersell, these facts support Plaintiff's argument that his claims “arise out of or relate to” Defendant's deployment of session replay technology on its website.
Defendant's argument that the “relevant conduct” is the “operation of a nationally accessible website and alleged use of ‘session replay' technology on that website” too narrowly frames the scope of the inquiry. In Ford Motor Company, the Supreme Court emphasized that the “arises out of or relates to” test “contemplates that some relationships will support jurisdiction without a causal showing.” Although doctrinal questions bearing on the applicability of the “related to” test with regard to internet transactions were left for another day, nothing in the Ford opinion bars application of the general proposition to these facts. Id. at 1028, n. 4. For purposes of the motion to dismiss, Plaintiff has sufficiently alleged that the claims “arise out of or relate to” Defendant's conduct.
Plaintiff has successfully satisfied both prongs of the personal jurisdiction test, and Defendant has not presented a “compelling case” that the exercise of jurisdiction would not be reasonable. Schwarzenegger, 374 F.3d at 802. Accordingly, the Court denies Defendant's motion to dismiss for lack of personal jurisdiction.
B. Failure to State a Claim
A 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A pleading must contain, in part, “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). But plaintiffs must also plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see also Fed. R. Civ. P. 12(b)(6). The plausibility standard demands more than “a formulaic recitation of the elements of a cause of action,” or “ ‘naked assertions' devoid of ‘further factual enhancement.' ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 557). Instead, the complaint “must contain allegations of underlying facts sufficient to give fair notice and to enable the opposing party to defend itself effectively.” Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011).
In reviewing a 12(b)(6) motion to dismiss, “[a]ll allegations of material fact are taken as true and construed in the light most favorable to the nonmoving party.” Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996). However, a court need not take legal conclusions as true merely because they are cast in the form of factual allegations. See Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987). Similarly, “conclusory allegations of law and unwarranted inferences are not sufficient to defeat a motion to dismiss.” Pareto v. FDIC, 139 F.3d 696, 699 (9th Cir. 1998).
1. Consent
Defendant argues that Plaintiff cannot state a claim under either provision of the CIPA because he fails to plead facts establishing lack of consent to Defendant's actions. (Mot. at 10 [ECF No. 30.]) Specifically, Defendant argues that each time Plaintiff placed an order on the website, he checked a box that confirmed he understood and agreed that his information would be collected and used as described in the Privacy Policy. (Id. at 1011). That Privacy Policy was hyperlinked on every page of the website and disclosed Papa John's data collection practice along with use of vendors. (Reply at 5). According to Defendant, Plaintiff must do more than merely allege lack of consent such as alleging additional facts showing Plaintiff did not have actual or constructive knowledge of the Privacy Policy. (Id.) Defendant claims that Plaintiff did not elect to have his data deleted despite being presented with that option in the Privacy Policy, and he continued to use the website, showing at a minimum his implied consent. (Id. at 11). Defendant further contends that Plaintiff's prior complaints suggested he placed orders online before October 3, 2022, outside CIPA's one-year statute of limitations period, making it implausible that he did not consent to any data collection that occurred after October 3, 2022. (Id. at 12 n. 4).
In response, Plaintiff argues that Defendant's consent defense turns on the outcome of multiple factual disputes which defeat dismissal at this stage, such as whether Plaintiff actually saw the privacy policy link on the website pages, what the link looked like, and whether the privacy policy adequately discloses that it uses session replay recording code. (Oppo. at 11). In addition, Plaintiff claims that reliance on the Privacy Policy is insufficient to show consent because it appears as a “browsewrap” agreement which does not require the user to expressly “manifest assent to the terms and conditions.” (Id.)
In the Complaint, Plaintiff clearly states that “Defendant never sought consent, and Plaintiff and Class Members never provided consent, for the unauthorized access and reading and recording of their electronic communications prior to it occurring.” (SAC at ¶ 76). This is sufficient to meet his burden to plead that he did not provide prior consent to the recording. See Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31, 2022) (holding that the plaintiff met his pleading burden by alleging that he did not provide express consent.) Moreover, the factual disputes regarding whether Plaintiff actually saw the Privacy Policy and consented to it are not suitable for resolution at this stage in the proceedings. See In re Tracht Gut, LLC, 836 F.3d 1146, 1150 (9th Cir. 2016) (“At the motion to dismiss phase, the trial court must accept as true all facts alleged in the complaint and draw all reasonable inferences in favor of the plaintiff.”) As a result, the Court declines to dismiss Plaintiff's CIPA claims based on consent. // //
2. First Cause of Action- Violation of the California Invasion of Privacy Act, Cal Penal Code § 631
Section 631(a) of the California Penal Code provides for civil and criminal liability where:
Any person who, by means of any machine, instrument, or contrivance, or any other matter, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable. Or instrument of any internal telephonic communication system, or who willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section” [violates this section].Cal. Penal Code § 631(a).
a) Party Exception
Defendant argues that Plaintiff cannot state a claim under section 631 because Papa John's was a party to the communication and any alleged interception is permitted under the “party exception”. (Mot. at 13). Plaintiff asserts that the party exception does not apply because the claim is based on derivative liability alleging that Defendant aided and abetted FullStory, who is not a party to the communications. (Oppo. at 14).
“Courts perform the same analysis for both the Wiretap Act and CIPA regarding the party exemption.” In re Facebook, Inc., v Internet Tracking Litigation, 956 F.3d 589, 607 (9th Cir. 2020). Only a third party can “eavesdrop” on a conversation, therefore a party to the communication is exempt from liability under section 631. See Warden v. Kahn, 99 Cal.App.3d 805, 811 (Ct. App. 1979). “The party exception must be considered in the technical context of [a] case.” In re Facebook, 956 F.3d at 607. District courts in California addressing the party exception have disagreed with Papa John's argument: “[I]t cannot be that anyone who receives a direct signal escapes liability by becoming a party to the communication. Someone who presses up against a door to listen to a conversation is no less an eavesdropper just because the sound waves from the next room reach his ears directly.” Revitch v. New Moosejaw, LLC, 2019 WL 5485330, at *2 (N.D. Cal. Oct. 23, 2019). In contrast, another Northern District of California court held that a tracking service provider was considered a participant in the conversation under § 631(a) because that defendant only stored user's data and did not use or resell that data, unlike the Moosejaw defendant. See Graham v. Noom, Inc., 533 F.Supp.3d 823, 833-34 (N.D. Cal. Apr. 8, 2021). In Graham, the court reasoned that the tracking defendant provided a tool, like a tape recorder, and therefore was not an eavesdropper. Id. at 833. Whether FullStory acts akin to a tape recorder or whether its actions are closer to “an eavesdropper standing outside the door” is a question of fact which is better answered after discovery into the session replay technical context of the case. See In re Facebook, 956 F.3d at 607; Yoon v. Lululemon USA, Inc., 1081 (C.D. Cal. 2021).
b) Intentional Wiretapping
According to Defendant, Plaintiff has not alleged that Defendant engaged in intentional wiretapping under the first clause of section 631(a) because online communications between a website and a visitor do not qualify. (Id. at 16). Plaintiff counters that the second prong of section 631(a) applies to internet communication, citing Javier, 2022 WL 1744107. (Oppo. at 16-17).
For Plaintiff to invoke the first clause of Section 631(a) which addresses intentional wiretapping, he must allege facts plausibly showing that Papa John's or its vendor made an unauthorized connection with a “telegraph or telephone wire, line, cable, or instrument.” Cal. Penal Code § 631(a). In an unpublished decision, the Ninth Circuit has indicated that “Section 631(a) applies to Internet communications” despite being written in terms of wiretapping. Javier, 2022 WL 1744107 at 1. In contrast, some district courts in the Ninth Circuit have found that the first clause of Section 631(a) does not apply to internet communications because the clause states that it applies only to telegraphic or telephone wire communications. See Byars v. Hot Topic, Inc., 656 F.Supp.3d 1051, 1065 n.8 (C.D. Cal. Feb. 14, 2023).
In Javier, the Court initially addressed the second clause of Section 631(a) but included language indicating that the holding applied to both clauses when it stated that “[t]hough written in terms of wiretapping, §631(a) applies to internet communications.” Javier, 2022 WL 1744107 at 1. Reading the first clause of Section 631 to apply only to communications through a wire ignores the fact that a statute may be read to apply to new technologies “where such a reading would not conflict with the statutory scheme.” Matera v. Google, Inc., 2016 WL 8200619 (N.D. Cal. Aug. 12, 2016)(citing Apple Inc., v. Superior Court, 56 Cal.4th 128, 137 (2013)(“Fidelity to legislative intent does not ‘make it impossible to apply a legal text to technologies that did not exist when the text was created.... Drafters of every era know that technological advances will proceed apace and that the rules they create will one day apply to all sorts of circumstances they could not possibly envision.”) For purposes of the present motion, the Court finds that Plaintiff has plausibly alleged a cause of action under the first clause of Section 631(a) and denies Defendant's motion to dismiss on this ground.
c) Contents of Communication
Finally, Defendant argues that the claim must be dismissed because Papa John's did not acquire the “contents” of a communication, as required under the second clause of section 631. (Id. at 17-18).
For purposes of Section 631(a)'s second clause Plaintiff must allege that Papa John's or its vendor “read, or attempts to read, or to learn the contents or meaning of any message, report, or communication.” Cal. Penal Code § 631(a). Courts analyzing CIPA claims apply the same definitions for the federal Wiretap Act where appropriate. Saleh v. Nike, Inc., 562 F.Supp.3d 503, 517 (C.D. Cal. 2021). “The Ninth Circuit has held that the ‘contents' of an online communication under federal wiretap law ‘refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication.'” Yoon, 549 F.Supp.3d at 1082 (citing In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014).
Here, Plaintiff asserted in the Complaint that:
[b]y using the spyware, Defendant and FullStory were able to learn much more about Plaintiff and class members including the pages and content they viewed, their scroll movements, words and text typed even if not fully entered, copy and paste actions, search terms (including what pizza sold by Defendant were available at the Genesee Avenue location in San Diego, California) even if not fully entered, mouse clicks and movements, keystrokes, and all other information related to the visit. Defendant tracked and recorded similar communications of other Class Members.(SAC at ¶ 42.)
Taking these allegations as true, the Court finds that Plaintiff has sufficiently alleged that Defendant intercepts the contents of internet communication rather than simply “record” information for purposes of the present motion. See Cahill, 80 F.3d 336, 337-38. For the above reasons, Plaintiff's Complaint is sufficient to state a cause of action under the second clause of Section 631(a) and the Court denies Defendant's motion to dismiss on this ground.
3. Second Cause of Action- Violation of California Invasion of Privacy Act-California Penal Code 632.7
Defendant moves to dismiss Plaintiff's second cause of action claiming that Plaintiff does not allege the communication involved two telephones as required under section 632.7. Further, Defendant argues that it is not clear whether the cell phone Plaintiff used can be considered a “phone” within the meaning of Section 632.7 because he used it as a smartphone with mobile browsing functionality to access the website. (Mot. at 19).
Section 632.7 imposes liability on anyone who aids in the interception and intentional recording of “a communication transmitted between two cellular radio telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a cordless telephone and a landline telephone, or a cordless telephone and a cellular radio telephone.” In interpreting a California statute, the Court “first looks to the language of the statute, giving effect to the words' plain meaning; ‘if the language is unambiguous, the plain meaning controls.'” Gonzales v. CarMax Auto Superstores, LLC, 840 F.3d 644, 650 (9th Cir. 2016) (quoting Voices of the Wetlands v. State Water Res. Control Bd., 257 P.3d 81, 93 (2011)). “A statute's plain meaning, however, cannot be determined without reference to the context in which the words are used.” Id.
The Court finds that the plain language of section 632.7 limits the applicability of the statute to communications between certain types of telephones, not the internet, and Plaintiff did not allege that the communication was between two telephones as required by statute. See Garcia v. Build.com, Inc., No. 22-CV-01985-DMS-KSC, 2023 WL 4535531, at *6 (S.D. Cal. July 13, 2023) (dismissing a section 632.7 claim where “Plaintiff makes no persuasive argument that the statute contemplates internet communications between a smart phone and an unspecified device on Defendant's end” (quotation omitted)). Indeed, “[t]ransmission by internet through a device called ‘phone' is not sufficient.” Id. Accordingly, Defendant's motion to dismiss Plaintiff's second cause of action is granted with leave to amend. See Knappenberger v. City of Phoenix, 566 F.3d 936, 942 (9th Cir. 2009) (“Leave to amend should be granted unless the district court determines that the pleading could not possibly be cured by the allegation of other facts.” (quotation omitted)).
C. Standing for Injunctive Relief
Defendant argues that Plaintiff lacks standing to seek injunctive relief because he does not and cannot allege he will again visit the Papa John's website without knowing about its use of session replay technology, therefore he cannot be wronged again in the manner alleged in the SAC. (Mot. at 20).
To successfully assert a claim for injunctive relief, a plaintiff must contend that, despite knowledge of the asserted violative conduct, he or she may suffer an “actual and imminent” threat of future harm. See Graham, 533 F.Supp.3d at 836.
[A] previously deceived consumer may have standing to seek an injunction against false advertising or labeling, even though the consumer now knows or suspects that the advertising was false at the time of the original purchase, because the consumer may suffer an “actual and imminent, not conjectural or hypothetical” threat of future harm. Knowledge that the advertisement or label was false in the past does not equate to knowledge that it will remain false in the future. In some cases, the threat of future harm may be the consumer's plausible allegations that she will be unable to rely on the product's advertising or labeling in the future, and so will not purchase the product although she would like to.Davidson v. Kimberley-Clark Corporation, 889 F.3d 956, 969 (9th Cir. 2018)(internal citations omitted).
Plaintiff has not sufficiently alleged that he and the class he seeks to represent intend to visit the site in the future. The Complaint merely avers that “The past invasions were actual and future invasions are imminent and will occur next time Plaintiff visits Defendant's website.” (SAC at ¶ 92). Plaintiff's request for injunctive relief is dismissed with leave to amend.
IV. CONCLUSION AND ORDER
For the forgoing reasons, Defendant's motion to dismiss Plaintiff's complaint for lack of personal jurisdiction is DENIED. Further, Defendant's motion to dismiss the first cause of action for violation of section 631 of the California Penal Code is DENIED. Defendant's motion to dismiss Plaintiff's second cause of action for violation of section 632.7 of the California Penal Code is GRANTED with leave to amend. Defendant's motion to dismiss Plaintiff's request for injunctive relief is GRANTED and the claim is dismissed with leave to amend.
IT IS SO ORDERED.