Hammerling et al v. Google LLC

Filing 64

ORDER by Judge Charles R. Breyer granting 57 Motion to Dismiss. (crblc2, COURT STAFF) (Filed on 12/1/2022)

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 1 of 25

1
2
3
4
5

IN THE UNITED STATES DISTRICT COURT

6

FOR THE NORTHERN DISTRICT OF CALIFORNIA

7
8

MARIE HAMMERLING, et al.,
Plaintiffs,

9

United States District Court
Northern District of California

Case No. 21-cv-09004-CRB
ORDER GRANTING MOTION TO
DISMISS

10

v.

11

GOOGLE LLC,
Defendant.

12
13

Defendant Google LLC (“Google”) moves to dismiss Plaintiffs Marie Hammerling

14

and Kay Jackson’s amended complaint. For the second time, Plaintiffs allege that Google

15

secretly used their Android smartphones to collect data regarding their use of third-party

16

apps. Plaintiffs allege that, through the collection of this data, Google “gains a wealth of

17

highly personal information about consumers” in order to “gain an unfair advantage

18

against its competitors.” Am. Compl. (dkt. 51) ¶¶ 3, 5. In its prior order, the Court

19

dismissed all of Plaintiffs’ claims against Google. See Hammerling v. Google LLC, No.

20

21-CV-09004-CRB, 2022 WL 2812188 (N.D. Cal. July 18, 2022). Plaintiffs renew those

21

claims in their amended complaint, alleging that Google breached its contract with its

22

customers and violated California’s Unfair Competition Law, the California Constitution,

23

and California fraud and privacy laws. Am. Compl. ¶¶ 119–222. Google again moves to

24

dismiss. Mot. (dkt. 57). Finding this matter suitable for resolution without oral argument

25

pursuant to Civil Local Rule 7-1(b), because Plaintiffs fail to cure the deficiencies outlined

26

in the Court’s prior order, the Court GRANTS Google’s motion to dismiss.

27

I.

28

BACKGROUND
In its prior order, the Court found that Plaintiffs had failed to state each of its ten

United States District Court
Northern District of California

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 2 of 25

1

claims: (1) common law intrusion upon seclusion; (2) invasion of privacy under the

2

California Constitution; (3) violation of California Civil Code section 1709; (4) violations

3

of the fraud, unlawful, and unfair prongs of California Civil Code section 17200 (“Unfair

4

Competition Law” or “UCL”); (5) violation of California Civil Code section 1750

5

(“California Consumers Legal Remedies Act” or “CLRA”); (6) breach of contract; (7)

6

breach of implied contract; (8) unjust enrichment; (9) relief under the Declaratory

7

Judgment Act; and (10) violation of California Penal Code section 631 (“California’s

8

Invasion of Privacy Act” or “CIPA”). See Hammerling, 2022 WL 2812188. Despite

9

noting that “many of the problems [outlined in the order would] be difficult to cure,” the

10

Court granted Plaintiffs leave to amend. Id. at *18. Plaintiffs amended their complaint,

11

leaving the vast majority of their allegations untouched; those facts are discussed in the

12

Court’s prior order. See Hammerling, 2022 WL 2812188, at *1–2. In their amended

13

complaint, Plaintiffs allege the following additional facts:

14

First, Plaintiffs allege that data about their use of third-party apps provided “unique

15

insights” into their lives; for example, through Hammerling’s use of the Fidelity

16

Investments and Bank of America apps, Google knew where Hammerling “maintained her

17

financial accounts.” Am. Compl. ¶ 18. Through other third-party apps downloaded to her

18

Android smartphone, Google could deduce that Hammerling had a home security system,

19

drove a Mazda, read the New York Times, and was physically active. Id. Similarly,

20

through Jackson’s use of the Joel Osteen, YouVersion Bible, and Bible Trivia apps,

21

Google knew Jackson’s religious beliefs. Id. ¶ 30.

22

Second, Plaintiffs highlight five pieces of specific information collected from

23

Hammerling’s use of third-party apps: (1) she visited the Wish app on March 10, 2021 and

24

viewed a foot massager, and on March 3, 2021 and viewed “womens slippers size 9”; (3)

25

she visited the Groupon app and viewed deals for “78% off Anti-inflammatory Meal

26

subscriptions” on October 13, 2019 and “100% Extra Virgin Coconut Oil” on May 10,

27

2020; and (3) she visited the Picsart Photo & Video Editor app on March 8, 2021. Id. ¶¶

28

19–21. For two of these pieces of data, Plaintiffs included data notices from
2

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 3 of 25

1

Hammerling’s Google account, which state that: “This activity was saved to your Google

2

Account because the following settings were on: additional Web & App Activity. You can

3

control these settings here.” Id. ¶¶ 19, 21. When Plaintiffs followed the link in that notice,

4

they allege that the Web & App Activity Activity Control only states that Google will

5

“Save[] your activity on Google sites and apps” and Google’s collection of Hammerling’s

6

third-party app data from Groupon, Wish, and Picsart was in violation of this

7

representation. Id. ¶ 23.1
Third, Plaintiffs allege that Hammerling read Google’s Privacy Policy and that she

8

United States District Court
Northern District of California

9

“did not understand this policy to mean (and did not agree) that Google would collect

10

sensitive data from” third-party apps she downloaded to her Android smartphone. Id. ¶ 25.

11

Plaintiffs do not allege that Jackson ever read the Policy.
Fourth and finally, Plaintiffs allege that this information was “not de-identified or

12
13

anonymized,” but that their interactions with third-party apps are “directly associated with

14

[their] Google Account[s].” See, e.g., id. ¶¶ 31, 65.

15

II.

LEGAL STANDARD
Under Federal Rule of Civil Procedure 12(b)(6), the Court may dismiss a complaint

16
17

for failure to state a claim upon which relief may be granted. Dismissal may be based on

18

either “the lack of a cognizable legal theory or the absence of sufficient facts alleged under

19

a cognizable legal theory.” Godecke v. Kinetic Concepts, Inc., 937 F.3d 1201, 1208 (9th

20

Cir. 2019) (cleaned up). A complaint must plead “sufficient factual matter, accepted as

21

true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662,

22

678 (2009) (cleaned up). A claim is plausible “when the plaintiff pleads factual content

23

that allows the court to draw the reasonable inference that the defendant is liable for the

24

misconduct alleged.” Id. When evaluating a motion to dismiss, the Court “must presume

25

all factual allegations of the complaint to be true and draw all reasonable inferences in

26
27
28

1

While Plaintiffs do not allege that any specific data of this kind was collected from Jackson, they
do allege that Google generally collected “highly specific data relating to” Jackson and that it also
violated affirmative representations regarding WAA as applied to her. Id. ¶¶ 31–32, 34.

3

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 4 of 25

1

favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir.

2

1987). “Courts must consider the complaint in its entirety, as well as other sources courts

3

ordinarily examine when ruling on Rule 12(b)(6) motions to dismiss, in particular,

4

documents incorporated into the complaint by reference, and matters of which a court may

5

take judicial notice.” Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322

6

(2007).
Claims for fraud must meet the pleading standard of Federal Rule of Civil

United States District Court
Northern District of California

7
8

Procedure 9(b), which requires a party “alleging fraud or mistake [to] state with

9

particularity the circumstances constituting fraud or mistake.” Rule 9(b) “requires . . . an

10

account of the time, place, and specific content of the false representations as well as the

11

identities of the parties to the misrepresentations.” Swartz v. KPMG LLP, 476 F.3d 756,

12

764 (9th Cir. 2007) (cleaned up). “This means that averments of fraud must be

13

accompanied by the who, what, when, where, and how of the misconduct charged.” In re

14

Google Assistant Priv. Litig., 546 F. Supp. 3d 945, 955 (N.D. Cal. 2021) (internal

15

quotation marks omitted).
If a court dismisses a complaint for failure to state a claim, it should “freely give

16
17

leave” to amend “when justice so requires.” Fed. R. Civ. P. 15(a)(2). A court has

18

discretion to deny leave to amend due to “undue delay, bad faith or dilatory motive on the

19

part of the movant, repeated failure to cure deficiencies by amendment previously allowed,

20

undue prejudice to the opposing party by virtue of allowance of the amendment, [and]

21

futility of amendment.” Leadsinger, Inc. v. BMG Music Pub., 512 F.3d 522, 532 (9th Cir.

22

2008).

23

III.

DISCUSSION

24

This order first considers Google’s request for incorporation by reference and

25

judicial notice. See Request for Judicial Notice (“RJN”) (dkt. 58). It next considers

26

Google’s argument that Plaintiffs consented to the data collection they allege in their

27

amended complaint. See Mot. at 5–8. It then addresses Google’s motion to dismiss in the

28

following order: (1) fraud claims (Section 1709, UCL’s fraud prong, and CLRA); (2)
4

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 5 of 25

1

privacy claims (common law intrusion upon seclusion, invasion of privacy under the

2

California Constitution, and CIPA); (3) contract claims (breach of contract, implied

3

contract, and unjust enrichment); (4) UCL’s unlawful and unfair prongs; and (5)

4

declaratory judgment claim.

5

A.

6

Google seeks incorporation by reference of eight documents: two versions of its

7

Privacy Policy, RJN Exs. A & B; and the website and Android versions of its “Activity

8

Controls,” RJN Exs. C–E; G–I. See RJN at 3. Plaintiffs do not oppose this request. See

9

RJN Opp’n (dkt. 59).
The incorporation-by-reference doctrine “treats certain documents as though they

10

United States District Court
Northern District of California

Incorporation by Reference (Exs. A–E, G–I)

11

are part of the complaint itself.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002

12

(9th Cir. 2018). Documents are subject to incorporation by reference if a plaintiff refers to

13

them “extensively” or they form the basis of the complaint. Id. Courts may properly

14

assume the truth of documents incorporated by reference. Id. at 1003. But “it is improper

15

to assume the truth of an incorporated document if such assumptions only serve to dispute

16

facts stated in a well-pleaded complaint.” Id.
The Court’s prior order on Google’s first motion to dismiss found that both versions

17
18

of Google’s Privacy Policy were incorporated by reference. They remain so for the same

19

reasons, based on Plaintiffs’ many references to them in their amended complaint. See

20

Hammerling, 2022 WL 2812188, at *3; see also, e.g., Am. Compl. ¶¶ 24, 33, 62–63, 73–

21

74.

22

The amended complaint, additionally, both quotes directly and references Google’s

23

“Activity Controls,” or webpages through which Plaintiffs were able to choose what types

24

of their data Google may retain. RJN Exs. C–E; G–I. Plaintiffs provide two notices from

25

Hammerling’s Google account, both of which state that: “This activity was saved to your

26

Google Account because the following settings were on: additional Web & App Activity.

27

You can control these settings here.” Am. Compl. ¶¶ 19 fig. 1, 21 fig. 2. Plaintiffs then

28

provide direct quotes from the page linked in both notices, but do not provide the full
5

United States District Court
Northern District of California

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 6 of 25

1

linked page. Id. ¶¶ 23, 32, 183. Google provides those linked pages (one before the Web

2

& App Activity setting is enabled, the other after) as Exhibits C & D in its request for

3

judicial notice. See Kanig Decl. (dkt. 58-1) at 1; RJN Ex. C; Ex. D (“WAA Disclosure”).

4

Further, Google provides an additional disclosure that pops up when a user chooses to

5

enable the “[i]nclude Chrome history and activity from sites, apps, and devices that use

6

Google services” option on the Web & App Activity (“WAA”) page, which Google calls

7

the “Additional Web & App Activity” (“AWAA”) disclosure. See Kanig Decl. at 1; RJN

8

Ex. E (“AWAA Disclosure”). Exhibits G, H and I are those same pages, as they appear on

9

Android smartphones. Kanig Decl. at 2; RJN Exs. G–I. Plaintiffs do not dispute the

10

authenticity of these webpages, nor that they are provided when Android users alter their

11

WAA settings, as Google explains in its declaration. See RJN Opp’n.

12

The Court finds that each of these webpages are properly incorporated by reference.

13

The Amended Complaint both references and quotes directly (though selectively) from the

14

WAA Disclosure, which, in turn, when a particular setting is selected, allows the AWAA

15

Disclosure to pop up. See Am. Compl. ¶¶ 23, 32; WAA Disclosure; AWAA Disclosure.

16

These documents are thus part of a singular whole and must be considered together,

17

particularly where Plaintiffs complain that they were not adequately informed about the

18

types of data Google collects from their Android smartphones. Khoja, 899 F.3d at 1002;

19

Al-Ahmed v. Twitter, Inc., No. 21-CV-08017-EMC, 2022 WL 1605673, at *4 (N.D. Cal.

20

May 20, 2022); see also, e.g., Am. Compl. ¶¶ 19, 21, 23, 32, 34. Thus, the Court

21

incorporates by reference Exhibits A–E and G–I to Google’s request for judicial notice.

22

B.

23

Google additionally seeks judicial notice of three documents: a page from its Help

Judicial Notice (Exs. F, J, K)

24

Center titled “Find & control your Web & App Activity”, see RJN Ex. F; a Privacy Policy

25

dated September 20, 2021 from the third-party app Wish, see RJN Ex. J; and an undated

26

disclosure from the Google Play Store regarding data collection by the third-party app

27

Groupon, see RJN Ex. K. Plaintiffs do not oppose the request as to the Help Center

28

webpage, but they do oppose the request as to the Wish Privacy Policy and Groupon
6

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 7 of 25

1

disclosure. RJN Opp’n at 3.
Courts may take judicial notice of a fact that is “not subject to reasonable dispute,”

2
3

i.e., that is “generally known” or “can be accurately and readily determined from sources

4

whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). “Publicly

5

accessible websites and news articles are among the proper subjects of judicial notice.”

6

Diaz v. Intuit, Inc., 15-cv-1778, 2018 WL 2215790, at *3 (N.D. Cal. May 15, 2018).

7

Courts may not, however, “take judicial notice of disputed facts contained in [] public

8

records.” Khoja, 899 F.3d at 999 (citation omitted).
Because Plaintiffs do not dispute the accuracy of the contents of the Help Center

United States District Court
Northern District of California

9
10

webpage, and because webpages like this one are regularly the subject of judicial notice in

11

this circuit, the Court takes judicial notice of Exhibit F. See, e.g., Brown v. Google LLC,

12

No. 20-CV-03664-LHK, 2021 WL 6064009, at *6–7 (N.D. Cal. Dec. 22, 2021).
Plaintiffs do, however, argue that it is improper to take judicial notice of the Wish

13
14

Privacy Policy and the Groupon disclosure, because they “have nothing to do with

15

Plaintiffs’ allegations, which concern only Google’s collection and interception of data

16

from non-Google apps through Android OS,” and that “Google takes no steps to explain

17

how or if Plaintiffs would have seen these documents in the course of purchasing and

18

using their Android devices.” RJN Opp’n at 1 (emphasis omitted).
The Court disagrees with Plaintiffs’ contention that such disclosures “have nothing

19
20

to do with [their] allegations,” but declines to take judicial notice of them nonetheless.

21

While it may be true that these are the most recent privacy policy and data disclosure for

22

Wish and Groupon respectively, they may not contain the same disclosures that

23

Hammerling may have read when she downloaded the apps or used them from 2019 to

24

2021.2 They thus contain no facts that can be “judicially noticeable for [their] truth.”

25

Khoja, 899 F.3d at 999. Whether and to what extent Wish and Groupon alerted

26

Hammerling that her data might be shared, and whether or to what extent they proceeded

27
28

2

The Court takes no position on whether Hammerling had the opportunity to review a privacy
policy or data disclosure when she downloaded the Wish or Groupon apps and began using them.

7

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 8 of 25

1

to share her data with third parties (perhaps Google), are questions of fact unresolved by

2

these disclosures and inappropriate to resolve on a motion to dismiss.

3
4

take judicial notice of Exhibits J and K.

5

C.

6

Google argues that, by including five allegations of data collection from

Consent

7

Hammerling’s Google account in the amended complaint, Hammerling admits to

8

consenting to the data collection practices at issue. Because Google fails to satisfy the

9

high bar for consent on a motion to dismiss, this argument fails.

10

United States District Court
Northern District of California

Thus, the Court takes judicial notice of Exhibit F but declines Google’s request to

In their amended complaint, Plaintiffs allege that Google tracked Hammerling’s

11

interaction with three third-party apps, including what product or service she viewed, the

12

date and time at which she viewed it, and the Google product she used at the time. See

13

Am. Compl. ¶¶ 19–21. Plaintiffs provide a notice from Google about the source of two

14

pieces of that data. Under a “Why is this here?” heading, the notice states: “This activity

15

was saved to your Google Account because the following settings were on: additional Web

16

& App Activity. You can control these settings here.” Id. ¶¶ 19 fig. 1, 21 fig. 2. Plaintiffs

17

claim that when they follow the link in those notices, Google states that if Web & App

18

Activity is enabled on that page, it will only “Save[] your activity on Google sites and

19

apps.” Id. ¶ 23. However, Google contends that Plaintiffs selectively quote from the Web

20

& App Activity page. See, e.g., Mot. at 6. Google provides the full Web & App Activity

21

disclosure, which also provides an additional choice for users to select: “Include Chrome

22

history and activity from the sites, apps, and devices that use Google services.” WAA

23

Disclosure; see also Ex. H (same). When users choose this setting, an additional

24

disclosure pops up, clarifying the “activity from sites, apps, and devices that use Google

25

services” that users may allow Google to collect, including: “app activity, including data

26

that apps share with Google”; and “Android usage and diagnostics, like battery level, how

27

often you use your device and apps, and system errors.” AWAA Disclosure; see also Ex. I

28

(same). Google argues that, because the notice in Figures 1 and 2 in the amended
8

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 9 of 25

1

complaint indicates that the “additional Web & App Activity” setting was enabled, not just

2

the “Web & App Activity” setting, then Hammerling must have “necessarily reviewed” the

3

AWAA Disclosure in order to enable that setting. Reply (dkt. 61) at 3. It would follow

4

that Hammerling consented to disclosure of her activity on third party apps “that use

5

Google services,” because the AWAA Disclosure tells her so. Google argues that this

6

consent requires dismissal of Plaintiffs’ fraud, privacy, and contract claims. Mot. at 7.
This argument fails because Google’s provision of its current AWAA Disclosure

United States District Court
Northern District of California

7
8

does not support the conclusion that Hammerling “necessarily reviewed” the same AWAA

9

Disclosure, and thus consented to it. Google provides only screenshots of the WAA and

10

AWAA Disclosures taken in September 2022. See Kanig Decl. at 1. Assuming that

11

Google’s Activity Controls were incorporated into its Privacy Policy, see id., there is no

12

indication that the disclosures in Google’s Activity Controls were the same when

13

Hammerling first enabled the setting, nor when her data was collected from third-party

14

apps from 2019 to 2021. See Am. Compl. ¶¶ 15, 19–21. For their part, while Plaintiffs

15

may admit that Hammerling enabled the setting at some point, and do admit that she

16

“necessarily saw” the WAA Disclosure,3 Plaintiffs do not admit that Hammerling saw the

17

AWAA Disclosure prior to Google’s request for judicial notice. See id. ¶ 23; see also

18

Opp’n at 16. Thus, it is possible that Hammerling enabled AWAA and did not see the

19

same, or any, disclosure regarding the additional data she was consenting to be collected

20

by Google.4
Google relies heavily on In re Facebook, Inc., Consumer Privacy User Profile

21
22

Litigation to argue that consent can be found on these facts, but that case is inapposite. In

23
24
25
26
27
28

It may be argued that because Plaintiffs admit that Hammerling “necessarily saw” the statement
at the top of the WAA Disclosure (“Saves your activity on Google sites and apps”) that she
necessarily saw (and chose) the additional setting (“Include . . . activity from sites, apps, and
devices that use Google services”). But because the Court cannot conclude that the WAA
Disclosure Hammerling saw was the same as the one provided by Google in its request for judicial
notice, consent cannot be found on this basis.
4
Indeed, it is not implausible that AWAA is, or at one point was, a default setting for Android
users, and thus the setting was enabled without the user having necessarily seen an AWAA
Disclosure.
3

9

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 10 of 25

1

Facebook Consumer Privacy, Judge Chhabria found that language in Facebook’s

2

Statement of Rights and Responsibilities and its Data Use Policy disclosed to users that

3

others may share their information with app developers, and that users must take specific

4

steps to prevent this. 402 F. Supp. 3d 767, 792 (N.D. Cal. 2019). It followed that users

5

that did not adjust their settings accordingly were “deemed to have agreed to the language”

6

in Facebook’s policies. Id. at 792–93. Google argues that it flows from Facebook

7

Consumer Privacy that, by enabling “additional App & Web Activity,” consent must be

8

found here and Plaintiffs’ fraud, privacy, and contract claims must be dismissed on this

9

basis. Mot. at 7–8.
But a key aspect of Facebook Consumer Privacy was that Judge Chhabria only

United States District Court
Northern District of California

10
11

found consent where the language in question was present at the time users signed up for

12

Facebook accounts in 2009. 402 F. Supp. 3d at 793–94. Whether users who signed up

13

before that language was added consented to it could not be resolved on a motion to

14

dismiss. Id. So too here: Google has not shown that the current AWAA Disclosure was

15

presented to users when Hammerling enabled the setting, and thus consent cannot be found

16

at this early stage as to her.5 What disclosure Hammerling was shown, and whether that

17

language is coextensive with the current AWAA Disclosure, would be questions of fact for

18

a later stage in the case. Nevertheless, Plaintiffs’ claims do not survive this motion to

19

dismiss because their amendments fail to cure the defects found in the Court’s prior order.

20

D.

21

In its prior order, the Court dismissed Plaintiffs’ fraud claims because (1) Plaintiffs

Fraud Claims (Claims 3, 4, and 5)

22

failed to allege that they actually relied on any alleged misrepresentation; and (2) Google

23

lacked a duty to disclose any alleged omission. The Court dismissed the CLRA claim for

24

the additional reason that Plaintiffs failed to allege a transaction under the CLRA.

25

Because Plaintiffs fail to cure these deficiencies in the amended complaint,

26
27
28

5

Because it is not clear from the amended complaint whether Jackson enabled the AWA or
AWAA setting, nor which disclosures she saw when she enabled that setting, this argument also
fails as applied to Jackson. See Am. Compl. ¶¶ 29, 32, 34.

10

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 11 of 25

1

Google’s motion to dismiss is again granted as to the CLRA, UCL fraud prong, and

2

Section 1709 claims.

3

1.

As the Court held in its prior order, to plausibly allege a CLRA, Section 1709, or

4

United States District Court
Northern District of California

Misrepresentation

5

UCL fraud claim on a misrepresentation theory, “a plaintiff must allege that they relied on

6

a misrepresentation and suffered injury as a result.” Hammerling, 2022 WL 2812188, at

7

*6 (citing Moore v. Apple, Inc., 73 F. Supp. 3d 1191, 1200 (N.D. Cal. 2014)). In their

8

initial complaint, Plaintiffs merely alleged that they “relied upon” the alleged

9

misrepresentations “when setting up their Android Smartphones.” Compl. (dkt. 1) ¶ 52.

10

In their amended complaint, Plaintiffs identify additional alleged misrepresentations, see,

11

e.g., Am. Compl. ¶¶ 23–24, and allege that one plaintiff, Hammerling, “read Google’s

12

Privacy Policy,” and that she “did not understand this policy to mean (and did not agree)

13

that Google would collect sensitive data from non-Google apps.” Id. ¶ 25.6 This statement

14

again fails to plead reliance. The additional allegation that Hammerling read the Privacy

15

Policy does not state when she read the policy, nor whether she purchased her Android

16

smartphone in reliance on the alleged misrepresentations in the policy. See Hammerling,

17

2022 WL 2812188, at *6 (citing Davidson v. Apple, Inc., 16-cv-4942, 2017 WL 976048,

18

at *8 (N.D. Cal. Mar. 14, 2017), and Donohue v. Apple, Inc., 871 F. Supp. 2d 913, 925

19

(N.D. Cal. 2012)).
Plaintiffs make three arguments against dismissal based on reliance, all of which are

20
21

unpersuasive.

22

First, Plaintiffs argue that they need not plead actual reliance based on the Privacy

23

Policy because “there is no indication that Google made a different statement or changed

24

its policy before Plaintiff purchased her device to create a different result.” Opp’n at 14.

25

Whether or not this is true, it is beside the point, which is whether Plaintiffs relied on

26

particular alleged misrepresentations to purchase the phones, to their detriment.

27
28

6

Plaintiffs do not allege that Jackson read the policy. See Am. Compl.

11

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 12 of 25

1

Hammerling, 2022 WL 2812188, at *6. If Hammerling read the Privacy Policy after she

2

purchased the phone, even if it was unchanged from the policy that existed prior to her

3

purchase, she did not purchase the phone in reliance upon the representations in the policy.

4

Because Plaintiffs do not allege that Hammerling read the policy prior to her purchase, this

5

argument fails.
Second, Plaintiffs argue that their claims in the amended complaint arise not only

United States District Court
Northern District of California

6
7

from the Privacy Policy but also from “the misrepresentations Google made on its settings

8

pages.” Opp’n at 15. Because Plaintiffs argue that they “could not have discovered” the

9

misrepresentations in these pages “until after purchasing their devices,” they need not

10

plead reliance prior to purchase. Id. Instead, they relied on these statements “by

11

continuing to use a device (and supply Google with data) when they otherwise would not

12

have if Google had disclosed the truth about its practices.” Id. But Plaintiffs cite only to

13

paragraphs in their amended complaint that reference only the fact that, had they known

14

“Google would collect [their] sensitive personal data without consent, [they] would not

15

have purchased, or would have paid significantly less for, [their] Android Smartphones.”

16

Am. Compl. ¶¶ 26, 35. They do not plead reliance based on continued use of their phones

17

after viewing the settings pages,7 and thus this theory too fails.
Third and finally, Plaintiffs argue that, with respect to their Section 1709 and UCL

18
19

claims, they allege that “Google’s collection of highly sensitive individualized data is a

20

cognizable harm,” and thus plead an injury of data collection separate and apart from their

21

purchase of the Android Smartphones. Opp’n at 15. Maybe so, but Plaintiffs do not plead

22

that they relied on a misrepresentation and suffered this injury as a result. See

23

Hammerling, 2022 WL 2812188, at *6. Rather, they only state that Google’s data

24

collection “necessarily occurs after Google misrepresented what data it would collect.”

25

Opp’n at 15. Because this is not an allegation of reliance on the misrepresentation, but

26

merely alleging that the alleged misrepresentation was made before the injury, this

27
28

7

Indeed, they do not plead that Hammerling or Jackson saw or reviewed these settings pages prior
to reviewing the privacy notices in the amended complaint.

12

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 13 of 25

1

argument also fails.
Therefore, to the extent Plaintiffs’ fraud claims are based on a misrepresentation

2
3

theory, they do not survive Google’s motion to dismiss.

4

2.

In its prior order, the Court dismissed Plaintiffs’ fraud claims based on an omission

5

United States District Court
Northern District of California

Omission

6

theory because in order to plead that Google had a duty to disclose the omitted fact,

7

Plaintiffs must allege that omitted information was “central to the product’s function.”

8

Hammerling, 2022 WL 2812188, at *8–9 (quoting Hodsdon v. Mars, Inc., 891 F.3d 857,

9

863 (9th Cir. 2018)). The Court concluded that because Google’s collection of data from

10

non-Google apps does not render the Plaintiffs’ smartphones “incapable of use” and does

11

not prevent their phones from “performing a critical or integral function,” any fraud claims

12

based on an omission theory must be dismissed. Id. at *9 (quoting Knowles v. ARRIS

13

Int’l PLC, 847 F. App’x 512, 513–14 (9th Cir. 2021), and Ahern v. Apple Inc., 411 F.

14

Supp. 3d 541, 567 (N.D. Cal. 2019)). Plaintiffs’ argument on this point—that “Google’s

15

secret collection of non-Google app data from Android device users impacts its ‘central

16

function’ because privacy is a key—if not the only—consideration in selecting a mobile

17

device”—is nearly identical to the one the Court dismissed in its prior order, and the Court

18

is not persuaded a second time. Opp’n at 17; Hammerling, 2022 WL 2812188, at *8

19

(finding that the argument that “[u]sing apps is at the heart of the smartphone experience”

20

does not prevent a smartphone from “performing a critical or integral function” or

21

otherwise render it “incapable of use”).8
In addition, to the extent that Plaintiffs allege a partial omission theory by alleging

22
23

that Hammerling reviewed the Privacy Policy, this new allegation still cannot survive a

24

motion to dismiss because it still does not meet the 9(b) standard. In its prior order, the

25
26
27
28

Plaintiffs’ reference to Flores-Mendez v. Zoosk, Inc., 20-cv-4929, 2022 WL 357500, at *4 (N.D.
Cal. Feb. 7, 2022), does not convince the Court otherwise. That case was about a data breach of a
dating website, where plaintiffs submitted “reputationally sensitive” “data about [their] romantic
lives and sexual preferences” based on representations that the data would be kept safe. Id. This
case implicates neither similarly reputationally sensitive data nor an alleged data breach.
8

13

United States District Court
Northern District of California

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 14 of 25

1

Court found that the Plaintiffs cannot rely on this theory because “Plaintiffs do not allege

2

that they ever read the Policy before (or after) purchasing their Android smartphones,

3

without which they could not have relied on this ‘partial omission.’” Hammerling, 2022

4

WL 2812188, at *7 n.7 (citing Anderson v. Apple, Inc., 500 F. Supp. 3d 993, 1018 (N.D.

5

Cal. 2020)). Plaintiffs argue that because the amended complaint alleges that Hammerling

6

read the Privacy Policy at an unspecified time, and because she “did not understand this

7

policy to mean (and did not agree) that Google would collect sensitive data from non-

8

Google apps,” that they have plausibly pleaded a partial omission. Opp’n at 16; Am.

9

Compl. ¶ 25. But, as discussed above, the amended complaint does not specify when

10

Hammerling reviewed the Privacy Policy—if it was prior to purchasing her smartphone, or

11

after her purchase and during its use. Further, while Plaintiffs’ opposition states that they

12

“necessarily saw” the alleged partial omissions in the WAA Disclosure, Plaintiffs do not

13

allege in their amended complaint that they ever actually encountered that disclosure prior

14

to reviewing Hammerling’s data notices. See Am. Compl. ¶¶ 19–23, 32. While Plaintiffs

15

are correct that alleging that one plaintiff has at least encountered the Privacy Policy is

16

more than the Anderson court had, the amended complaint still fails to allege Plaintiffs’

17

encounters with these alleged partial omissions with 9(b) particularity. See Anderson, 500

18

F. Supp. 3d at 1019.9

19

3.

CLRA

20

In its prior order, the Court held that to state a qualifying transaction under the

21

CLRA, a plaintiff must plead that the defendant is either “(1) the manufacturer of the

22

product or (2) a party that received some portion of the product’s sale.” Hammerling, 2022

23

WL 2812188, at *10. Because Plaintiffs pleaded neither, the Court dismissed the CLRA

24

claim on this additional ground. Id. In their amended complaint, Plaintiffs attempt to cure

25

this defect by alleging that Google earns “substantial profit through Android Smartphones

26
27
28

Because the Court dismisses Plaintiffs’ fraud claims based on an omission theory for these
reasons, it need not address Google’s additional arguments for dismissal based on actual reliance
and California’s economic loss rule. See Hammerling, 2022 WL 2812188, at *9 n.9.
9

14

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 15 of 25

1

that incorporate Android OS.” Am. Compl. ¶ 45. But while Plaintiffs may have alleged

2

that Google may profit off of a user’s ownership and continued use of a device running on

3

Android OS, they fail to allege that Google made any money directly off of the sale of

4

Hammerling and Jackson’s devices (nor any devices manufactured by third parties). See

5

Decarlo v. Costco Wholesale Corp., 14-cv-202, 2020 WL 1332539, at *9 (S.D. Cal. Mar.

6

23, 2020). Plaintiffs thus still fail to plead a qualifying transaction under the CLRA.
Because Plaintiffs’ fraud claims fail for the foregoing reasons, the Court grants

7
8

Google’s motion to dismiss the CLRA, UCL fraud prong, and Section 1709 claims.

United States District Court
Northern District of California

9

E.

Privacy Claims (Claims 1, 2, and 10)

10

In its prior order, the Court dismissed Plaintiffs’ privacy claims because (1)

11

Plaintiffs failed to plead that the intrusion was “highly offensive”; and (2) as to the CIPA

12

claim, they failed to plead that Google learned the “contents” of their interactions with

13

third-party apps.

14

Because Plaintiffs again fail to plausibly plead these claims in their amended

15

complaint, Google’s motion to dismiss is granted as to the common-law privacy claim, the

16

constitutional privacy claim, and the CIPA claim.

17

1.

Privacy Under the Common Law and State Constitution

In its prior order, the Court found that while Plaintiffs had alleged a reasonable

18
19

expectation of privacy in the frequency and duration of their use of third-party apps, they

20

had not plausibly alleged that that intrusion was “highly offensive.” Hammerling, 2022

21

WL 2812188, at *10–11. In their amended complaint, Plaintiffs attempt to cure this defect

22

by pointing out the third-party apps that they used and what those apps may have told

23

Google about them, as well as five allegations of specific data collection of Hammerling’s

24

activity on three third-party apps. See Am. Compl. ¶¶ 18–21, 30. Because these

25

allegations still fail to amount to a “highly offensive” intrusion,10 Plaintiffs’ privacy

26
27
28

10

Because the Court does not find that Plaintiffs consented to this data collection, see supra
Section III.C, it does not accept Google’s argument that Plaintiffs have failed to plead a reasonable
expectation of privacy in the data they alleged that Google collected. See Reply at 8. The Court
finds that Plaintiffs still plead a reasonable expectation of privacy under the circumstances.

15

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 16 of 25

1
2

To determine whether an intrusion was highly offensive, courts consider factors

3

such as “the likelihood of serious harm to the victim, the degree and setting of the

4

intrusion, the intruder’s motives and objectives, and whether countervailing interests or

5

social norms render the intrusion inoffensive.” In re Facebook, Inc. Internet Tracking

6

Litig., 956 F.3d 589, 606 (9th Cir. 2020). The Court found in its prior order that Plaintiffs

7

had not alleged “that the data allegedly collected by Google is sufficiently specific or

8

personal, and its collection sufficiently harmful, to be highly offensive.” Hammerling,

9

2022 WL 2812188, at *12. Taking Plaintiffs’ new allegations one by one, they still do not

10

United States District Court
Northern District of California

claims under the common law and state constitution must again be dismissed.

reach this bar.

11

First, Plaintiffs allege the personal information that Google may have gleaned from

12

their use of their third-party apps: Hammerling’s bank and where she kept her investments,

13

through her use of the Fidelity Investments and Bank of America apps; what car she drove,

14

through her use of the MyMazda app; where she reads her news and her interest in

15

cooking, through her use of the New York Times and NYT Cooking apps; and that she

16

was physically active and interested in straightening her teeth, through use of related apps.

17

Am. Compl. ¶ 18. Plaintiffs allege that information about Jackson’s religious beliefs could

18

be gleaned from her use of various religious apps, and her interest in privacy through her

19

use of a privacy browser. Id. ¶ 30.

20

These allegations still do not render any tracking of the use of these apps highly

21

offensive. Fundamentally, Plaintiffs do not allege that Google could glean any personal

22

information from these apps’ frequency of use or duration; Plaintiffs simply allege that

23

Google could learn personal information about them through their download of third-party

24

apps alone. See Opp’n at 7. But Google already discloses that it does collect information

25

when a user installs an app from the Google Play Store onto their device. RJN Ex. A at 3

26

(“We collect this information when a Google service on your device contacts our servers –

27
28

Hammerling, 2022 WL 2812188, at *10–11.

16

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 17 of 25

1

for example, when you install an app from the Play Store . . . .”); id. (“This information

2

includes things like your device type, carrier name, crash reports, and which apps you’ve

3

installed.”). Plaintiffs do not allege that any tracking of the frequency or duration of use of

4

these apps would allow Google to gain any other particular knowledge about them that was

5

not already disclosed from the download of the apps themselves. See, e.g., Hammerling,

6

2022 WL 2812188, at *13. As a result, such an intrusion is not highly offensive.
Second, Plaintiffs allege that Google has collected more granular information from

United States District Court
Northern District of California

7
8

Hammerling’s interaction with three third-party apps.11 Specifically, Plaintiffs allege

9

notices from Google that Hammerling (1) visited the Wish app on March 10, 2021 and

10

viewed a foot massager, and on March 3, 2021 and viewed “womens slippers size 9”; (3)

11

visited the Groupon app and viewed deals for “78% off Anti-inflammatory Meal

12

subscriptions” on October 13, 2019 and “100% Extra Virgin Coconut Oil” on May 10,

13

2020; and (3) visited the Picsart Photo & Video Editor app on March 8, 2021. Am. Compl.

14

¶¶ 19–21. While more specific than the first alleged data collection, this data still is not

15

sufficiently personal, nor its collection sufficiently harmful, to be highly offensive.
First, it is mentioned in the Privacy Policy and WAA Disclosure that Google can,

16
17

and does, collect data from non-Google apps that use Google services. See, e.g., RJN Ex.

18

A at 4 (“The activity information we collect may include . . . [a]ctivity on third-party sites

19

and apps that use our services.”); WAA Disclosure (“Include Chrome history and activity

20

from sites, apps, and devices that use Google services”). While the Court cannot conclude

21

that Plaintiffs have affirmatively consented to the collection of this data, see supra Section

22

III.C, this data collection is also not “blatantly deceitful,” as in other cases where highly

23

offensive intrusions have been found. See Hammerling, 2022 WL 2812188, at *12 (citing

24

Facebook Tracking, 956 F.3d at 603). Plaintiffs have not alleged, for example, that they

25

understood that Wish, Groupon, and Picsart did not use Google services, or that they had

26
27
28

11

Plaintiffs do not allege any specific interaction with third-party apps that was linked to
Jackson’s account. However, they do allege that there is at least some “data in Plaintiff Jackson’s
account relating to non-Google apps.” Am. Compl. ¶ 32.

17

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 18 of 25

1

disabled Google’s ability to collect such data from third-party apps that use Google

2

services prior to these specific instances of data collection. And as Plaintiffs themselves

3

point out, they have access to this data collection via their Google accounts, where they

4

can “control the[] settings” that allow the collection to occur. Am. Compl. ¶¶ 19, 21. This

5

data collection was not “surreptitious” and thus less likely to be found to be highly

6

offensive. Facebook Tracking, 956 F.3d at 606 & n.8.
Second, and most fundamentally, the data collected from these particular intrusions

United States District Court
Northern District of California

7
8

is not sufficiently egregious to be characterized as highly offensive. Hammerling’s

9

searches of a foot massager, slippers, meal subscriptions, coconut oil, and use of a photo

10

editor are better characterized as data collection of “routine commercial behavior,” not

11

considered a highly offensive intrusion of privacy in this district. See Low v. LinkedIn

12

Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012); see also Hammerling, 2022 WL

13

2812188, at *12 (citing In re Google Inc. Priv. Pol’y Litig., 58 F. Supp. 3d 968, 988 (N.D.

14

Cal. 2014), and In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1063 (N.D. Cal.

15

2012)). Though Plaintiffs have pleaded that Google has collected these five pieces of de-

16

anonymized disparate information,12 they do not plausibly allege that Google has recorded

17

“each and every intimate interaction taken on the users’ devices, allowing Google to

18
19
20
21
22
23
24
25
26
27
28

12

In its prior order, the Court found that, even if the data described by Plaintiffs were deanonymized, it still does not amount to a highly offensive intrusion. See Hammerling, 2022 WL
2812188, at *12 n.11. The Court is not persuaded to alter this finding based on the cases provided
by Plaintiffs. In Revitch v. New Moosejaw, LLC, 18-cv-6827, 2019 WL 5485330 (N.D. Cal. Oct.
23, 2019), Judge Chhabria found that a jury could conclude that an intrusion was highly offensive
in part because Revitch alleged that defendants “scanned Revitch’s computer for files that
revealed his identity and browsing habits.” Id. at *3. No similarly invasive intrusion is alleged
here. In McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022 (N.D. Cal. 2019), plaintiffs alleged that
gaming apps targeted toward minor children collected user data and disseminated it to third parties
in order to “track, profile, and target children with targeted advertising,” and the Court could not
find that such an intrusion was not highly offensive on a motion to dismiss. Id. at 1029–30, 1035–
36. This case concerns neither alleged data collection from and targeting of minor children, nor
dissemination to third parties. Finally, in Rodriguez v. Google LLC, 20-cv-4688, 2021 WL
2026726 (N.D. Cal. May 21, 2021), plaintiffs did not allege that they enabled WAA. Id. at *8. In
this case, while consent cannot be found at this stage, Plaintiffs have at least alleged that WAA
was enabled, and thus it cannot be said that Google “set an expectation” that such data would not
be collected, especially because it appears that Plaintiffs are able to alter their settings to disallow
its collection. Id.; see also Am. Compl. ¶¶ 19, 21; WAA Disclosure.

18

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 19 of 25

1

develop comprehensive profiles on its users.” Opp’n at 9.13 Thus, Google’s motion to

2

dismiss as to Plaintiffs’ common-law and constitutional privacy claims is granted.

3

2.

In its prior order, the Court dismissed Plaintiffs’ CIPA claim because they failed to

4

United States District Court
Northern District of California

CIPA Claim

5

plausibly allege that, by tracking the frequency and duration of Plaintiffs’ use of third-

6

party apps, Google learned the “contents” of Plaintiffs’ communications with those apps,

7

as required under § 631. Hammerling, 2022 WL 2812188, at *14–15; see also Cal. Pen.

8

Code § 631. In response to their amended complaint, Google argues that Plaintiffs still fail

9

to make out a CIPA claim, because: (1) Plaintiffs’ new allegations are still not the

10

“contents” of a communication within the meaning of § 631; (2) Plaintiffs do not plausibly

11

allege that Google intercepted their data while “in transit”; and (3) Plaintiffs do not allege

12

that the interception occurred within the state of California.14

13

a.

Contents

While the Court held in its prior order that the information alleged—when and for

14
15

how long Plaintiffs used third-party apps on their Android devices—was not the “contents”

16

of Plaintiffs’ communications under the CIPA, Hammerling, 2022 WL 2812188, at *14–

17

15, the amended complaint cures this defect. Plaintiffs now allege that Google not only

18

collected data regarding “when and how often they interact” with third party apps, but

19

particular activity on those apps, including products they searched for and services they

20
21
22
23
24
25
26
27
28

The Court is similarly unpersuaded that Plaintiffs’ alleged motive for Google’s data
collection—that “Google was using the data for its own purposes,” see Opp’n at 6—alters this
conclusion. Google’s Privacy Policy states that it uses the information it collects to “build better
services,” including to “[m]aintain and improve [its] services,” “[d]evelop new services,” and
“[p]rovide personalized services, including content and ads.” RJN Ex. A at 5; see also RJN Ex. C
(“The data saved in your account helps give you more personalized experiences across all Google
services.”). The provision of new, improved, and more personalized services is fundamentally
compatible with, and largely indistinguishable from, Google’s “commercial purposes.” See, e.g.,
Am. Compl. ¶ 33.
14
Google makes two additional arguments: (1) that because Plaintiffs consented to the data
collection, it cannot be unauthorized; and (2) that Hammerling’s interactions with Wish, Groupon,
and Picsart are not “communications” as a matter of law. Mot. at 17. Because the Court does not
find that Plaintiffs consented, it does not accept Google’s first argument; and because the Court
finds that Plaintiffs have not plausibly pleaded their CIPA claim for other reasons as detailed
above, it need not address Google’s second argument.
13

19

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 20 of 25

1

used within the application. Am. Compl. ¶¶ 19–21; Hammerling, 2022 WL 2812188, at

2

*1. This suffices to plead that the information at issue is “contents” under the CIPA. Cf.

3

Facebook Tracking, 956 F.3d at 605 (“These terms and the resulting URLs could divulge a

4

user’s personal interests, queries, and habits on third-party websites operating outside of

5

Facebook’s platform.”).

6

United States District Court
Northern District of California

7

b.

“In Transit”

However, Plaintiffs have not plausibly pleaded that those contents were intercepted

8

while “in transit.” Cal. Pen. Code § 631. In their amended complaint, Plaintiffs only

9

allege that Google collected “real-time data” about their use of third-party apps: See Am.

10

Compl. ¶ 4 (“Google employees have been able to monitor and collect real-time sensitive

11

personal data . . . .”); id. ¶ 49 (quoting the Committee on the Judiciary’s description of

12

Google’s data collection as “a covert effort to track real-time data on the usage and

13

engagement of third-party apps”); id. ¶ 53 (quoting the Committee on the Judiciary’s

14

conclusion that “Google’s internal reports show that Google was tracking in real-time the

15

average number of days users were active on any particular app”). Plaintiffs argue that this

16

plausibly alleges that Google “monitored and collected sensitive data in real time as users

17

were interacting with third-party apps.,” and thus that it intercepts that data while “in

18

transit.” Opp’n at 10.

19

But allegations that Google collects “real-time data” do not plausibly allege that

20

Google collects data while “in transit.” It is, for example, beyond dispute that Google

21

collected Hammerling’s “real-time data” from her visit to the Wish app on March 10,

22

2021. See Am. Compl. ¶ 19 fig.1. But that fact does not plausibly allege that Google

23

intercepted that data at that time; it may have collected that data from Wish at a later date.

24

Simply put, real-time data need not be collected in real time, and Plaintiffs do not plausibly

25

allege any mechanism that would allow Google to do so. See Rodriguez v. Google LLC,

26

20-cv-4688, 2022 WL 214552, at *2 (N.D. Cal. Jan. 25, 2022); In re Vizio, Inc., Consumer

27
28
20

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 21 of 25

1

Priv. Litig., 238 F. Supp. 3d 1204, 1228 (C.D. Cal. 2017).15

United States District Court
Northern District of California

2

c.

Intercepted in California

3

Further, Plaintiffs fail to allege that the data in question was intercepted in

4

California, as is required under the CIPA. Cal. Pen. Code § 631 (“passing over any wire,

5

line, or cable, or is being sent from, or received at any place within this state”). Plaintiffs

6

argue that they have alleged that “all of Google’s conduct occurs from within California

7

where it is headquartered and the data at issue is collected, stored, and used.” Opp’n at 11.

8

While it may well be true that the data at issue is “collected, stored, and used” in

9

California, that allegation is nowhere to be found in the amended complaint. See Am.

10

Compl. ¶ 12 (alleging that the Court has personal jurisdiction over Google because “its

11

principal place of business is in California” and “a substantial part of the events and

12

conduct giving rise to Plaintiffs’ claims occurred in California”); id. ¶ 13 (asserting that

13

venue is proper); id. ¶ 116 (alleging that Google “conduct[s] substantial business in

14

California”); id. ¶ 117 (“California is the state from which Google’s alleged misconduct

15

emanated.”). The fact that Plaintiffs are out-of-state residents or that California law

16

applies, see id. ¶¶ 15, 27, 114, has no bearing on whether the interception at issue took

17

place in California. Because Plaintiffs do not plead this element, their CIPA claim fails for

18

this additional reason.
Accordingly, Google’s motion to dismiss is granted with respect to Plaintiffs’ CIPA

19
20

claim.

21

F.

22

In its prior order, the Court found that: (1) Plaintiffs had failed to allege a promise

Contract Claims (Claims 6, 7, 8)

23

that Google had breached; (2) Plaintiffs cannot allege an implied contract where an express

24

contract already exists covering the same subject matter; and (3) Plaintiffs cannot allege an

25
26
27
28

15

This case is distinguishable from Campbell v. Facebook, Inc., 77 F. Supp. 3d 836 (N.D. Cal.
2014), and In re Carrier IQ, 78 F. Supp. 3d 1051 (N.D. Cal. 2015), where the parties alleged the
mechanisms by which the defendant allegedly intercepted the messages at issue. Campbell, 77 F.
Supp. 3d at 840; In re Carrier IQ, 78 F. Supp. 3d at 1078. The amended complaint, by
comparison, fails to allege any process by which Google intercepts this data in transit.

21

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 22 of 25

1

unjust enrichment claim when they fail to plead that Google committed an actionable

2

misrepresentation or omission. Because Plaintiffs’ amended complaint does not cure these

3

deficiencies, Google’s motion to dismiss as to the contract claims is granted.

4

Breach of Contract

5

In its prior order, the Court found that the statements in the Privacy Policy

6

highlighted by Plaintiffs “do not plausibly amount to a promise to collect data only from

7

Google apps or third-party apps that use Google services.” Hammerling, 2022 WL

8

2812188, at *16. In their amended complaint, Plaintiffs still fail to allege such an express

9

promise.

10

United States District Court
Northern District of California

1.

Plaintiffs cite statements characterizing the Privacy Policy, such as that it is “meant

11

to help users understand what information [Google] collect[s], why [it] collect[s] it, and

12

how [users] can update, manage, export, and delete their information,” and that it attempts

13

to explain these issues “as clearly as possible.” RJN Ex. A at 1. As found in the Court’s

14

prior order, such statements are not express promises, but aspirational and prefatory

15

statements. Hammerling, 2022 WL 2812188, at *16. Regarding Google’s Activity

16

Controls, Plaintiffs point to statements like users “have choices regarding the information

17

[Google] collect[s] and how it’s used” via “key controls for managing your privacy across

18

[its] services.” Opp’n at 2 (quoting RJN Ex. A at 7–8); see also Opp’n at 3 (stating that the

19

WAA setting “[s]aves your activity on Google sites and apps” (quoting WAA Disclosure)

20

(emphasis omitted)). But Plaintiffs do not allege that Google has failed to provide such

21

choices, or that Plaintiffs have not been able to use those controls; in fact, they allege that

22

they have enabled particular settings in Google’s Activity Controls. See Am. Compl. ¶¶

23

19, 21. Plaintiffs further argue that the introductory statements in the Privacy Policy,

24

combined with the statements regarding the Activity Controls, represent to users that

25

“Google had provided them a comprehensive list of all the data Google collects and why.”

26

Opp’n at 7. But an express promise of such a “comprehensive list” was never made. See

27

Hammerling, 2022 WL 2812188, at *16; RJN Ex. A (“The activity information we collect

28

may include . . . .”); WAA Disclosure (“[I]nclude Chrome history and activity from sites,
22

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 23 of 25

1

apps, and devices that use Google services”). And while Google states that it collects data

2

to give users “more personalized experiences,” it does not promise that that is the only

3

reason it collects such data. See WAA Disclosure; see also RJN Ex. A at 5 (stating in the

4

Privacy Policy that Google uses the information it collects to “build better services,”

5

including to “[m]aintain and improve [its] services,” “[d]evelop new services,” and

6

“[p]rovide personalized services”). Taken together, these statements do not allege a

7

promise that has been breached.16

8

2.

In its prior order, the Court dismissed Plaintiffs’ implied contract claim because

9

United States District Court
Northern District of California

Implied Contract

10

“there is a valid express contract covering the subject matter,” which requires the dismissal

11

of any implied contract claim. See Hammerling, 2022 WL 2812188, at *16 (quoting Be

12

In, Inc. v. Google Inc., 12-cv-3373, 2013 WL 5568706, at *5 (N.D. Cal. Oct. 9, 2013)).

13

Because there is still an express contract governing the subject matter of the implied

14

contract claim—the “scope and purpose of data collection”—the implied contract claim

15

must again be dismissed. Id.17

16

3.

Unjust Enrichment

In its prior order, the Court found that because Plaintiffs failed to allege an

17
18

actionable misrepresentation or omission, Plaintiffs’ unjust enrichment claim could not

19

stand. Hammerling, 2022 WL 2812188, at *17. Because the Court again finds that

20

Plaintiffs’ fraud claims cannot survive a motion to dismiss, their unjust enrichment claims

21
22
23
24
25
26
27
28

Plaintiffs’ reliance on Brown v. Google LLC, 20-cv-3664, 2021 WL 6064009 (N.D. Cal. Dec.
22, 2021), is misplaced. In that case, Google had made express promises that it would not save
particular data while users were in Incognito mode. See, e.g., id. at *13 (“Chrome won’t save . . .
[y]our browsing history [or] [c]ookies and site data.”). No similar promises were made here.
17
Plaintiffs argue that, because “Google seeks to expand the scope of the case beyond” the
Privacy Policy at issue in the Court’s prior order to additional disclosures in Google’s Activity
Controls, Opp’n at 13, that an implied contract is created when considering those documents in
addition to the Privacy Policy. First, Plaintiffs referred to (but did not attach) additional
documents in the amended complaint; so Plaintiffs themselves expanded the scope of the case.
See Am. Compl. ¶¶ 23, 32. But second, and more fundamentally, Google’s Activity Controls are
incorporated into the Privacy Policy, and thus are part of the express contract between Google and
its users. See RJN Ex. A at 8; WAA Disclosure; see also Facebook Consumer Privacy, 402 F.
Supp. 3d at 791; Brown, 2021 WL 6064009, at *9–10.
16

23

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 24 of 25

1

must also be dismissed.18

2

G.

3

In its prior order, the Court found that because Plaintiffs’ predicate claims failed,

4

their UCL claims under the unlawful prong must fail. Hammerling, 2022 WL 2812188, at

5

*15. Additionally, because “the ‘conduct’ on which Plaintiffs base their claims under all

6

three UCL prongs is the same,” the UCL claims under the unfair prong must also fail. Id.

7

at *15. Because the Plaintiffs’ predicate claims in their amended complaint still fail,

8

Plaintiffs cannot allege a claim under the unlawful prong.
Plaintiffs argue that their claim under the unfair prong should survive nonetheless,

9

United States District Court
Northern District of California

Remaining UCL Claims

10

because “Google’s covert collection of consumer data without consent directly violates

11

California’s strong public policy of protecting privacy rights.” Opp’n at 19 (citing

12

Cappello v. Walmart, Inc., 394 F. Supp. 3d 1015, 1024 (N.D. Cal. 2019)). But in Cappello

13

the plaintiffs had survived a prior motion to dismiss on a privacy claim; here, the Court

14

dismisses each of Plaintiffs’ privacy claims. Cappello, 394 F. Supp. 3d at 1017; see also

15

supra Section III.E. Therefore, because “the unfair prong of the UCL cannot survive if the

16

claims under the other two prongs . . . do not survive,” Plaintiffs’ claim under the unfair

17

prong must be dismissed. Hammerling, 2022 WL 2812188, at *15 (quoting Eidmann v.

18

Walgreen Co., 522 F. Supp. 3d 634, 647 (N.D. Cal. 2021)).

19

Thus, Plaintiffs’ remaining UCL claims are dismissed.

20

H.

21

Finally, Plaintiffs renew their claim for relief under the Declaratory Judgment Act.

Declaratory Judgment (claim 9)

22

Because “if the underlying claims are dismissed, . . . then there is no basis for any

23

declaratory relief,” the Court grants the motion to dismiss on this claim. Hammerling,

24

2022 WL 2812188, at *17 (quoting Muhammad v. Conner, 10-cv-1449, 2012 WL

25
26
27
28

Plaintiffs’ reference to In re Google Location Hist. Litig., 514 F. Supp. 3d 1147 (N.D. Cal.
2021) does not convince the Court otherwise. That case concerned collection and storage of
location data, which is only discussed briefly in the Privacy Policy and not at all in the Terms of
Service. Id. at 1159. Conversely, the collection of the types of user data at issue in this case is
addressed throughout the Privacy Policy, and thus the allegations are tied to the terms of an
express contract. See RJN Ex. A at 3; 5–8.
18

24

Case 3:21-cv-09004-CRB Document 64 Filed 12/01/22 Page 25 of 25