Hazel v. Prudential Fin.

1

TYRONE HAZEL, et al., Plaintiffs, v. PRUDENTIAL FINANCIAL, INC., et al., Defendants.

No. 22-cv-07465-CRB

United States District Court, N.D. California

June 9, 2023

ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS

CHARLES R. BREYER, UNITED STATES DISTRICT JUDGE

Plaintiffs Tyrone Hazel, Roxane Evans, Valerie Torres, and Rhonda Hyman allege that Prudential Financial employed a software provider, ActiveProspect (together, “Defendants”) to collect their information without their consent as they sought a life insurance quote. See Am. Compl. (dkt 18). Plaintiffs bring claims for violations of Section 631 of the California Invasion of Privacy Act (“CIPA”) Invasion of Privacy under the California Constitution, and the California Unfair Competition Law (“UCL”). Id. ¶¶ 89-121.

This action is just the latest in a long line of cases challenging the use of third-party software to record website visitors' activity without their knowledge, including ActiveProspect's “TrustedForm” software in particular.^[1] In a related case, Javier v. Assurance IQ, the Court held that the plaintiff had plausibly pleaded that ActiveProspect was a third-party eavesdropper within the meaning of Section 631(a). Javier v. Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 114225, at *3-6 (N.D. Cal. Jan. 5, 2023). That order, however, did not address Defendants' primary argument for dismissal of the Section 631(a) claim here: That Plaintiffs fail to plead that their communications on Prudential's website were intercepted “in transit.” Mot. (dkt. 21) at 6-9.

Finding this matter suitable for resolution without oral argument pursuant to Civil Local Rule 7-1(b), as explained below, the Court DENIES Defendants' motion as to Plaintiffs' Section 631(a) and Invasion of Privacy claims, and GRANTS Defendants' motion as to Plaintiffs' UCL claim.

I. BACKGROUND

Prudential runs an online platform for users to seek life insurance quotes. Am. Compl. ¶ 1. A user enters information about their demographics, family situation, and medical history, and then clicks “Continue, I Agree,” which signals that the user has “received Prudential's Privacy Notice,” which they can review by clicking a link on that same page. Id. ¶¶ 43, 45. Prudential's privacy notice states that it “may share your personal information, including information about your transactions and experiences, among Prudential companies and with other non-Prudential companies who perform services for us or on our behalf, for our everyday business purposes.” Id. ¶ 46.

Prudential partners with ActiveProspect to provide software for its website. Id. ¶ 36. ActiveProspect makes a software product called “TrustedForm,” a “lead certification product” that helps businesses authenticate user interactions with a website and document user consent. Id. ¶ 24. Specifically, TrustedForm is a piece of code that can be pasted into a webpage to record “keystrokes, mouse clicks, data entry, and other electronic communications of visitors to websites,” id. ¶ 28, and “begins the moment a user accesses or interacts with” that webpage. Id. ¶ 29. As a result, a website owner has a record of a users' entire interaction on its webform, which is hosted on ActiveProspect's servers. Id. ¶¶ 30-31.

Plaintiffs each visited Prudential's website between March 2022 and January 2023. Id. ¶¶ 57, 61, 65, 69. They entered the requested information, including medical information, to obtain a life insurance quote. Id. ¶¶ 59, 63, 67, 71. Plaintiffs assert that they did not know, as they filled out the webform on Prudential's website, that their information was also being “intercepted” by ActiveProspect. Id. ¶¶ 60, 64, 68, 72.

II. LEGAL STANDARD

Under Rule 12(b)(6) of the Federal Rules of Civil Procedure, a complaint may be dismissed for failure to state a claim for which relief may be granted. Fed.R.Civ.P. 12(b)(6). Rule 12(b)(6) applies when a complaint lacks either a “cognizable legal theory” or “sufficient facts alleged” under such a theory. Godecke v. Kinetic Concepts, Inc., 937 F.3d 1201, 1208 (9th Cir. 2019). Whether a complaint contains sufficient factual allegations depends on whether it pleads enough facts to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678. When evaluating a motion to dismiss, the Court “must presume all factual allegations of the complaint to be true and draw all reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). However, it is “not bound to accept as true a legal conclusion couched as a factual allegation.” Papasan v. Allain, 478 U.S. 265, 286 (1986); Clegg v. Cult Awareness Network, 18 F.3d 752, 754-55 (9th Cir. 1994).

III. DISCUSSION

The Court addresses the Plaintiffs' claims in the following order: First, their claim under Section 631(a) of CIPA; second, their claim for invasion of privacy under the California Constitution; and finally, their claim under the unlawful and unfair prongs of the UCL.

A. Section 631(a)

Defendants argue that Plaintiffs' CIPA claim should be dismissed for two reasons.

First, Plaintiffs fail to plausibly plead that their communications were intercepted “in transit”; and second, they fail to plausibly plead that ActiveProspect was a third-party eavesdropper.

1. “In Transit”

To bring a claim under the second prong of Section 631(a), a plaintiff must plead that another person “willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.” Cal. Penal Code § 631(a) (emphasis added).

Courts often look to the federal Wiretap Act, which prohibits the unauthorized “intercept[tion]” of an “electronic communication,” to interpret the “in transit” prong of Section 631(a). See, e.g., Licea v. Cinmar, LLC, No. CV 22-6454-MWF (JEM), 2023 WL 2415592, at *9 (C.D. Cal. Mar. 7, 2023); cf. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606-07 (9th Cir. 2020) (applying the same caselaw to interpret the “party exception” to the federal Wiretap Act and Section 631). Under the Wiretap Act, courts define “interception” narrowly: for data to be “intercepted,” “it must be acquired during transmission, not while it is in electronic storage.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002); see also NovelPoster v. Javitch Canfield Grp., 140 F.Supp.3d 938, 951-954 (N.D. Cal. 2014) (applying Konop to dismiss Wiretap Act and CIPA claims). Thus, “any ‘interception under the meaning of the statute must occur during transmission of the communication.” NovelPoster, 140 F.Supp.3d at 953 (citing Konop, 302 F.3d at 878); see also Mastel v. Miniclip SA, 549 F.Supp.3d 1129, 1137 (E.D. Cal. 2021) (“[T]he crucial question under § 631(a)'s second clause is whether [plaintiff] has plausibly alleged that [defendant] read one of his communications while it was still in transit, i.e., before it reached its intended recipient.”).

Plaintiffs allege that ActiveProspect's software “records consumer interactions with a website in real time.” Am. Compl. ¶ 2. By embedding ActiveProspect's TrustedForm software onto their webforms, websites can “surreptitiously observe and record visitors' keystrokes, mouse clicks, and other electronic communications,” beginning from the moment a user accesses the webpage, through TrustedForm's “VideoReplay” feature. Id. ¶¶ 3, 25, 29. This “data collection occurs in real time,” when “the verification server [ActiveProspect] collects information about the visitor and the lead generator [Prudential] during the communication session.” Id. ¶ 30. Once a user is moving through the webform, ActiveProspect's server “begins to monitor the webpage for any changes,” that is, any mouse movements, mouse clicks, scrolling, or data entry. Id. ¶ 31. These VideoReplay files are then stored on ActiveProspect servers. Id. ¶ 33.

Plaintiffs' allegations are far more specific than the conclusory allegations regularly held to fail to plead an interception “in transit” under CIPA and the Wiretap Act. See, e.g., Rosenow v. Facebook, Inc., No. 19-CV-1297-WQH-MDD, 2020 WL 1984062, at *7 (S.D. Cal. Apr. 27, 2020) (pleading only that “Yahoo knowingly used an algorithm to intercept and scan Plaintiff's incoming chat messages for content during transit before placing them in electronic storage” was conclusory); Rodriguez v. Google LLC, No. 20-CV-04688-RS, 2022 WL 214552, at *2 (N.D. Cal. Jan. 25, 2022) (“Using the word ‘intercept' repeatedly is simply not enough without the addition of specific facts that make it plausible Google is intercepting their data in transit.”); Valenzuela v. Keurig Green Mountain, Inc., No. 22-CV-09042-JSC, 2023 WL 3707181, at *5 (N.D. Cal. May 24, 2023) (holding that allegations that do “little more than restate the pleading requirement of real time interception” do not state a claim under CIPA).

Further neither of the two documents Defendants point to-ActiveProspect's TrustedForm patent nor the article on ActiveProspect's community forum-squarely contradict Plaintiffs' allegations.^[2] Defendants point to Figure 1 of the patent, which shows the visitor (i.e., Plaintiffs), with an arrow pointing to the lead generator (i.e., Prudential) and two arrows from the lead generator to the verification server ...