Greenley v. Kochava, Inc.

684 F.Supp.3d 1024

David GREENLEY, Plaintiff, v. KOCHAVA, INC., Defendant.

Case No. 22-cv-01327-BAS-AHG

United States District Court, S.D. California

Signed July 27, 2023

Alexander Elliot Wolf, John J. Nelson, Milberg Coleman Bryson Phillips Grossman PLLC, San Diego, CA, Joshua Brandon Swigart, Swigart Law Group, APC, San Diego, CA, Daniel O. Herrera, Pro Hac Vice, Nickolas J. Hagman, Pro Hac Vice, Cafferty Clobes Meriwether & Sprengel LLP, Chicago, IL, Peter F. Barry, Pro Hac Vice, The Barry Law Office, Ltd., Minneapolis, MN, for Plaintiff.

Craig J. Mariam, Elena A. Kuzminova, Hazel Mae Pangan, Gordon Rees Scully Mansukhani LLP, San Diego, CA, for Defendant.

ORDER:

1. GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS (ECF No. 11); AND

2. DENYING DEFENDANT'S MOTION FOR VENUE TRANSFER (ECF No. 21)

Cynthia Bashant, United States District Judge

Pending before the Court are two motions. First, Defendant moves to dismiss the action pursuant to Federal Rule of Civil Procedure ("Rule") 12(b)(1), asserting a lack of standing, and Rule 12(b)(6), asserting a failure to state a claim upon which relief may be granted. (MTD, ECF No. 11.) Second, Defendant moves to transfer venue pursuant to 28 U.S.C. § 1404(a). (Mot. Venue, ECF No. 21.) Having considered the parties' filings, the Court GRANTS IN PART and DENIES IN PART Defendant's Motion to Dismiss (ECF No. 11) and DENIES Defendant's Motion for Venue Transfer (ECF No. 21).

BACKGROUND

I. Factual Background

Defendant is a "data broker[ ]" that provides a software developer kit ("SDK") to software application ("app") developers "to assist them in developing their apps." (Am. Compl. ¶ 6, ECF No. 10.)¹ In return, the app developers allow Defendant to "surreptitiously intercept location data" from an app user ("user") via its SDK. (Id.) Defendant then sells "customized data feeds to its clients"—such as Airbnb, Disney +, and Kroger—to "assist in advertising and analyzing foot traffic at stores or other locations." (Id. ¶¶ 7, 83.) In other words, Defendant coded its SDK for data collection and embedded it in third-party apps; the SDK secretly collected app users' data; and then Defendant packaged that data and sold it to clients for advertising purposes.

Defendant is "able to deliver targeted advertising . . . by in essence 'fingerprinting' each unique device and user, as well as connecting users across devices and devices across users." (Id. ¶ 75.) The data links longitude and latitude coordinates with these fingerprints, which can be "easily de-anonymized." (Id. ¶¶ 7-8.) In addition to geolocation, Defendant collects "search terms, click choices, purchase decisions and/or payment methods." (Id. ¶ 125.) This data collection allows Defendant to deliver "targeted advertising . . . while tracking [users'] locations, spending habits, and personal characteristics" and share this "rich personal data simultaneously with untold numbers of third-party companies." (Id. ¶ 75.)

Plaintiff is a California resident filing a putative class action suit on behalf of similarly situated California residents. (Id. ¶¶ 1, 35.) Plaintiff has installed and used apps that have integrated Defendant's SDK. (Id. ¶¶ 36-37.) As a result, Defendant has collected "personal information," geolocation data, and communications from his cellular telephone. (Id. ¶ 23.) This geolocation data includes visits to "sensitive locations." (Id. ¶ 24.) Other data includes advertisement clicks; "specific communications from [ ] SDK-installed apps such as consumer's usernames, customer emails and customer IDs on their Apple or Android cellular telephone devices"; "search terms used by a device user"; and "a user's activities within an app after it has been installed." (Id. ¶¶ 76, 78-80.)

Plaintiff avers Defendant's own conduct and statements demonstrate its wrongdoing. In response to pressure from the Federal Trade Commission ("FTC"), Defendant announced a "new feature that allegedly now blocks the gathering of private, sensitive, location data related to health care facilities." (Id. ¶ 105.) This "Privacy Block" removes "health services location data from the Kochava Collective marketplace." (Id.) Plaintiff claims this new feature evidences that "Defendant recognizes the damage it has done to California consumers." (Id.)

In addition, Plaintiff alleges that Defendant has circumvented attempts to safeguard users' privacy. (Id. ¶¶ 71-73.) For example, Apple, Inc. ("Apple"), in response to growing privacy concerns, created a framework that requires users to "affirmatively opt-in to allowing Defendant and others to track their device unique identification number for advertisers on their iPhones." (Id. ¶¶ 68-69.) After Apple implemented this framework, Defendant advertised that it collects identifying data "even after a consumer thinks [he has] disabled all tracking by apps on an iPhone." (Id. ¶ 73.)

II. Litigation Background

On August 12, 2022, Defendant filed a federal lawsuit against the FTC in the District of Idaho. (Ex. A to Mariam Decl., ECF No. 21-4.) Defendant sought declaratory relief that it did not violate any laws. (Id.) On August 29, 2022, the FTC filed a Complaint against Defendant also in the District of Idaho. (Ex. B to Mariam Decl., ECF No 21-5.) One week later, Plaintiff filed this lawsuit against Defendant. (ECF No. 1.) Plaintiff alleges violations of the California Constitution, California Computer Data Access and Fraud Act ("CDAFA"), California Invasion of Privacy Act ("CIPA"), California Unfair Competition Law ("UCL"), and common law principles of unjust enrichment. (Am. Compl.) Defendant then filed the present Motion to Dismiss. (MTD.)

Five months after Plaintiff filed his Complaint in this district, Cindy Murphy, a Washington resident, filed a putative class action against Defendant in the District of Idaho alleging unjust enrichment and violations of the Washington Consumer Protection Act. (Ex. C to Mariam Decl., ECF No. 21-6.) After Ms. Murphy filed her lawsuit, Defendant filed the present Motion to Change Venue in this action. (Mot. Venue.)

STANDING

I. Legal Standard

Article III of the Constitution limits federal courts' jurisdiction to the "resolution of 'Cases' and 'Controversies.' " TransUnion LLC v. Ramirez, 594 U.S. 413, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021). This limitation means the plaintiff must have standing to sue. Id. A plaintiff establishes standing by showing (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief. Id. (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)).

Under Rule 12(b)(1), a party may move to dismiss a claim based on lack of subject matter jurisdiction, including the absence of standing. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010). A Rule 12(b)(1) challenge to jurisdiction may be facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Defendant's Motion to Dismiss is facial, positing the allegations in the complaint itself are insufficient to invoke federal jurisdiction. See id. at 1039; (MTD.) As a result, the presumption of truthfulness attaches to the allegations in the complaint, and the court is limited to the four corners of the pleading in determining whether it has jurisdiction over the matter. Thornhill Publ'g Co. v. Gen. Tel. Elec., 594 F.2d 730, 733 (9th Cir. 1979). To survive a Rule 12(b)(1) facial challenge, "the plaintiff must 'clearly . . . allege facts demonstrating' each element [of standing]." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975)).

II. Analysis

Defendant asserts Plaintiff fails to plausibly allege any of the standing requirements—injury in fact, causation, and redressability. The Court analyzes each prong and concludes that Plaintiff has adequately pled all three.

A. Injury in Fact

"To establish injury in fact, a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.' " Spokeo, 578 U.S. at 339, 136 S.Ct. 1540 (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130). A "concrete" injury "must be 'de facto'; that is, it must actually exist." Id. at 340, 136 S.Ct. 1540 (citing Black's Law Dictionary 479 (9th ed. 2009)). Although "the most obvious" concrete harms are tangible—e.g., physical or monetary, "various intangible harms can also be concrete." TransUnion, 141 S. Ct. at 2204. These include injuries "with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts," such as "reputational harms, disclosure of private information, and intrusion upon seclusion." Id.

"A right to privacy 'encompass[es] the individual's control of information concerning his or her person.' " In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)). Violations of this right fall into the category of traditionally recognized harms. Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019) (recognizing the "common law roots of the right to privacy"). As a result, intrusions into privacy can constitute an injury in fact.

The Ninth Circuit's recent opinion in In re Facebook is instructive. 956 F.3d 589. The issue was whether Facebook-users had standing to sue Facebook, Inc. ("Facebook") for tracking their browsing histories after they had logged out of Facebook. Id. at 595-96. The Ninth Circuit reasoned that Facebook's practices enable it to "amass a great degree of personalized information . . . without affording users a meaningful opportunity to control or prevent the unauthorized exploration...