In re Facebook Internet Tracking Litig.

263 F.Supp.3d 836

IN RE FACEBOOK INTERNET TRACKING LITIGATION

Case No. 5:12–md–02314–EJD

United States District Court, N.D. California, San Jose Division.

Signed June 30, 2017

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS

EDWARD J. DAVILA, United States District Judge

Plaintiffs allege that Defendant Facebook, Inc. violated their privacy by tracking their browsing activity on third-party websites. This Court previously granted Facebook's motion to dismiss, with leave to amend, for lack of standing and failure to state a claim. Plaintiffs filed an amended complaint, and Facebook now moves to dismiss. Facebook's motion will be GRANTED.

I. BACKGROUND

Facebook operates a social networking website.¹ Second Am. Consolidated Class Action Compl. ("SAC") ¶ 16, Dkt. No. 93. Third-party websites can embed Facebook "like" buttons to let users share content on Facebook—for instance, CNN can embed "like" buttons on news articles that it publishes on http://www.cnn.com/ to let users share content with their Facebook friends. Id. ¶ 49. To make the "like" button appear on the page, CNN embeds a small code snippet that Facebook provides. Id. That code snippet causes the user's browser to send a background request to Facebook's servers. Id. That request includes the URL of the page where the "like" button is embedded, as well as the contents of "cookies"—small text files—that Facebook has stored on that user's browser. Id. ¶¶ 3, 52.

Plaintiffs allege that Facebook uses "like" buttons to track Plaintiffs' web browsing activity. Id. ¶¶ 3–5. Because URLs are transmitted to Facebook each time a user visits a page that contains a "like" button, Plaintiffs allege that Facebook violated various privacy laws by collecting detailed records of Plaintiffs' private web browsing history. Id. Plaintiffs allege that Facebook's cookies enable it to uniquely identify users and correlate their identities with their browsing activity, even when users are logged out of Facebook. Id. ¶¶ 48–49. As discussed below, Plaintiffs also allege that Facebook circumvented certain privacy settings of the Internet Explorer web browser. Id. ¶¶ 85–101.

Plaintiffs' initial class-action complaint alleged various statutory and common-law privacy violations. Dkt. No. 35. Facebook moved to dismiss. Dkt. No. 44. This Court granted Facebook's motion to dismiss, with leave to amend, on the grounds that Plaintiffs failed to establish Article III standing with respect to some of their claims, and that Plaintiffs failed to state a claim with respect to the rest. Order Granting Def.'s Mot. to Dismiss ("MTD Order"), Dkt. No. 87. Plaintiffs filed an amended complaint alleging violations of the federal Wiretap Act, 18 U.S.C. §§ 2510 et seq. (SAC ¶¶ 179–92); violations of the federal Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701 et seq. (SAC ¶¶ 193–208); violations of the California Invasion of Privacy Act ("CIPA"), Cal. Crim. Code §§ 631, 632 (SAC ¶¶ 209–19); invasion of privacy under the California Constitution (SAC ¶¶ 220–31); intrusion upon seclusion (SAC ¶¶ 232–41); breach of contract (SAC ¶¶ 242–52); breach of the duty of good faith and fair dealing (SAC ¶¶ 253–61); fraud, Cal. Civ. Code §§ 1572, 1573 (SAC ¶¶ 262–69); trespass to chattels (SAC ¶¶ 270–73); violations of the California Comprehensive Computer Data Access and Fraud Act ("CDAFA"), Cal. Penal Code § 502 (SAC ¶¶ 274–85); and larceny, Cal. Penal Code §§ 484, 496 (SAC ¶¶ 286–95).² Facebook now moves to dismiss the SAC under Fed. R. Civ. P. 12(b)(1) and 12(b)(6). Def.'s Mot. to Dismiss ("MTD"), Dkt. No. 101.

II. LEGAL STANDARD

A. Rule 12(b)(1)

Dismissal under Fed. R. Civ. P. 12(b)(1) is appropriate if the complaint fails to allege facts sufficient to establish subject-matter jurisdiction. Savage v. Glendale Union High Sch., 343 F.3d 1036, 1039 n.2 (9th Cir. 2003). The Court "is not restricted to the face of the pleadings, but may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction." McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988). The nonmoving party bears the burden of establishing jurisdiction. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010).

B. Rule 12(b)(6)

A motion to dismiss under Fed. R. Civ. P. 12(b)(6) tests the legal sufficiency of claims alleged in the complaint. Parks Sch. of Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal "is proper only where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory." Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). The complaint "must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ).

III. DISCUSSION

A. Standing

To establish Article III standing, a plaintiff must have "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision."

Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). The plaintiff bears the burden of proving these elements. Id.

The plaintiff's injury must be "particularized" and "concrete." Id. at 1548. To be particularized, it "must affect the plaintiff in a personal and individual way." Id. To be concrete, it must be real, not abstract. Id. at 1548–49. A concrete injury can be tangible or intangible. Id. A plaintiff cannot "allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirements of Article III." Id. at 1549. A plaintiff does not "automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. However, a statutory violation can confer standing when the "alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id."In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." Id. If a plaintiff lacks Article III standing to pursue a claim, then the claim must be dismissed for lack of subject-matter jurisdiction. Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 101–02, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998).

i. Wiretap Act, SCA, and CIPA

This Court previously found that Plaintiffs had established standing for their Wiretap Act, SCA, and CIPA claims. MTD Order 13–15. Economic injury is not required to establish standing under any of those three statutes. See In re Google Inc. Gmail Litig., No. 13–md–02430–LHK, 2013 WL 5423918, at *16 (N.D. Cal. Sept. 26, 2013) ("courts in this district have found that allegations of a Wiretap Act violation are sufficient to establish standing"); In re iPhone Application Litig., 844 F.Supp.2d 1040, 1055 (N.D. Cal. 2012) ("Other courts in this district have recognized that a violation of the Wiretap Act or the Stored Communications Act may serve as a concrete injury for the purposes of Article III injury analysis."); Gaos v. Google, Inc., No. 10-cv-4809-EJD, 2012 WL 1094646, at *3 (N.D. Cal. Mar. 29, 2012) ("a violation of one's statutory rights under the SCA is a concrete injury"); Cal. Penal Code § 637.2 ("It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages."); In re Google Inc. Gmail Litig., 2013 WL 5423918, at *17 ("the Court finds that CIPA and the Wiretap Act are not distinguishable for the purposes of standing").

Plaintiffs allege that Facebook "intercepts" and "tracks" their internet communications in violation of all three statutes. SAC ¶¶ 179–219. These allegations are sufficient to confer standing for Plaintiffs' Wiretap Act, SCA, and CIPA claims.

ii. Trespass to Chattels, CDAFA, Fraud, and Larceny

This Court previously found that Plaintiffs did not establish standing for their claims for trespass to chattels and violations of the CDAFA. MTD Order 8–11. Unlike the statutory claims discussed above, claims for trespass to chattels and CDAFA violations require a showing of economic harm or loss. To prevail on a claim for trespass to chattels based on access to a computer system, a plaintiff must establish that (1) the defendant intentionally and without authorization interfered with the plaintiff's possessory interest in the computer system and (2) the defendant's unauthorized used proximately caused damage to the plaintiff. eBay, Inc. v. Bidder's Edge, Inc., 100 F.Supp.2d 1058, 1069–70 (N.D. Cal. 2000). The property owner "may recover only the actual damages suffered by reason of the impairment of the property or the loss of its use." Id. at 1070 (quoting Itano v. Colonial Yacht Anchorage, 267 Cal.App.2d 84, 90, 72 Cal.Rptr. 823 (1968) ). Likewise, to prevail on a CDAFA claim, "Plaintiffs must allege they suffered damage or loss by reason of a violation of Section 502(c)." In re Google Android Consumer Privacy Litig., No. 11-MD-02264-JSW, 2013 WL 1283236, at *5, *11 (N.D. Cal. Mar. 26, 2013) (finding that the plaintiffs had standing to pursue a CDAFA claim where they alleged that the defendant's conduct drained the batteries of their mobile devices).

In their SAC, Plaintiffs have added claims for fraud ( Cal. Civ. Code § 1572 ), constructive fraud ( Cal. Civ. Code § 1573 ), and larceny ( Cal. Penal Code §§ 484, 496 ). SAC ¶¶ 262–69, 286–95. As with claims for trespass to chattels and violations of the CDAFA, Plaintiffs' fraud claims require a showing of actual damage. See Rodriguez v. JP Morgan Chase & Co., 809 F.Supp.2d 1291, 1296 (S.D. Cal. 2011) (noting that a § 1572 claim requires (1) misre...