Libman v. Apple, Inc.

Filing 138

ORDER GRANTING IN PART AND DENYING IN PART 122 MOTION TO DISMISS. Signed by Judge Edward J. Davila. (ejdlc1, COURT STAFF) (Filed on 9/26/2024)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6

SAN JOSE DIVISION

7
ELLIOT LIBMAN, et al.,

8

Plaintiffs,

9
v.

10

ORDER GRANTING IN PART AND
DENYING IN PART MOTION TO
DISMISS

APPLE, INC.,

11

United States District Court
Northern District of California

Case No. 22-cv-07069-EJD

Defendant.

12

Re: ECF No. 122

13
Plaintiffs bring this class action against Apple for the alleged improper collection and use

14
15

of Apple mobile device users’ data when they interact with Apple’s proprietary applications

16

(“apps”)—including the App Store, Apple Music, Apple TV, Books, and Stocks (collectively,

17

“Apple Apps”)—on their mobile Apple devices (i.e., iPhone, iPad, or Apple Watch).

18

Consolidated Class Action Complaint (“CAC” or “complaint”), ECF No. 115 ¶¶ 1–6. Plaintiffs

19

allege that Apple misled users that certain settings would restrict Apple’s collection, storage, and

20

use of private data, when in fact Apple disregarded these choices and collected, stored, and used

21

the data anyway.
Before the Court is Apple’s motion to dismiss Plaintiffs’ complaint with prejudice under

22
23

Federal Rules of Civil Procedure 9(b), 12(b)(1) and 12(b)(6). Motion to Dismiss (“Mot.” or

24

“Motion”), ECF No. 122. Having reviewed the parties’ papers, and having considered the

25

arguments of counsel, the Court GRANTS IN PART and DENIES IN PART Apple’s motion.

26

I.

27
28

BACKGROUND
Plaintiffs are Ashley Popa, Bruce Puleo, Barry Robinson, Carlina Green, David Sgro, A.H.

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
1

United States District Court
Northern District of California

1

(a minor, with Julie Hodges serving as their guardian ad litem), Dottie Nikolich, Elena Nacarino,

2

Francis Barrott, Katie Alvarez, Jarell Brown, Julia Cima, Elizabeth Kelly, E.M. (a minor, with

3

Daryl Marcott serving as their guardian ad litem), and Quincy Venter (“Plaintiffs”) who, on behalf

4

of themselves and all others similarly situated, allege that Apple improperly collects and uses

5

Apple mobile device users’ data even when Apple allows them to choose settings that purportedly

6

restricted Apple’s collection, storage, and use of such data. CAC ¶ 1.

7

In Plaintiffs’ view, Apple has emphasized its purported commitment to consumer privacy

8

through its aggressive marketing strategies, including an ad campaign that began running in 2019

9

focused on user privacy protections. Id. ¶¶ 32–34. In contradiction of these privacy promises,

10

Plaintiffs allege Apple improperly collects and uses their data when they interact with Apple

11

Apps; Plaintiffs do not challenge any data collected from interactions with non-Apple apps. Id.

12

Specifically, Apple allegedly tracks and collects large swaths of personal information from

13

Plaintiffs when they use Apple Apps, including “details about app usage, app browsing

14

communications, personal information, and information relating to the mobile device itself.”

15

Id. ¶ 4.

16

Plaintiffs’ complaint centers on two settings Plaintiffs allege govern the data collection at

17

issue: the “Allow Apps to Request to Track” setting and the “Share [Device] Analytics” setting.

18

Id. ¶¶ 45–46. The “Allow Apps to Request to Track” setting states: “Allow apps to ask to track

19

your activity across other companies’ apps and websites. When this is off, all new app tracking

20

requests are automatically denied.” When the “Allow Apps to Request to Track” setting is turned

21

off, Plaintiffs allege that Apple promises that Apple Apps cannot “access the system advertising

22

identifier (IDFA), which is often used to track” and are “not permitted to track your activity using

23

other information that identifies you or your device, like your email address.” Id. ¶ 45. In

24

connection with this setting, Apple promises that it “requires app developers to ask for permission

25

before they track your activity across Apps or websites they don’t own.” Id. ¶ 105. The second

26

setting at issue, the “Share [Device] Analytics” setting, states: “Help Apple improve its products

27

and services by automatically sending daily diagnostic and usage data. Data may include location

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
2

1

information. Analytics uses wireless data.” Plaintiffs allege that, by turning off the “Share

2

[Device] Analytics” setting, Apple promised that Plaintiffs could “disable the sharing of Device

3

Analytics altogether.” Id. ¶ 46. If these two settings were turned off, Plaintiffs assert that Apple

4

promised Plaintiffs that their user data would not be collected. Despite those promises, Apple

5

“continu[ed] to collect user data whenever Plaintiffs and the Class interacted with Apple’s Apps,

6

such as the App Store, Apple Music, Apple TV, Books, and Stocks,” even when users turned off

7

the two settings. See, e.g., id. ¶ 116.
Plaintiffs filed their original complaint on November 10, 2022, bringing claims for unjust

8

United States District Court
Northern District of California

9

enrichment (or alternatively, breach of contract), violation of the California Invasion of Privacy

10

Act, and invasion of privacy under California’s constitution. ECF No. 1. Thereafter, the case was

11

related to other cases against Apple. See ECF Nos. 26, 35, 38, 40. The case was stayed on

12

February 10, 2023, pending resolution of motions to consolidate and to appoint interim lead

13

counsel. ECF No. 27. On March 24, 2023, the Court granted the parties’ stipulation to

14

consolidate. ECF No. 60; see also ECF Nos. 86, 96. The Court appointed a Plaintiffs’ Steering

15

Committee on July 18, 2023. ECF No. 107.
On October 6, 2023, Plaintiffs filed a consolidated amended complaint individually and on

16
17

behalf of a class of similarly situated individuals alleging Apple’s conduct: (1) breaches express

18

contracts; (2) breaches implied contracts; (3) breaches the implied covenant of good faith and fair

19

dealing; (4) amounts to an invasion of privacy; (5) violates California’s Invasion of Privacy Act;

20

(6) violates California’s Unfair Competition Law; (7) violates Pennsylvania’s Wiretapping and

21

Electronic Surveillance Act; (8) violates New York Gen. Bus. Law § 349; (9) violates New York

22

Gen. Bus. Law § 350; (10) violates New Jersey’s Consumer Fraud Act; (11) violates Illinois’s

23

Consumer Fraud and Deceptive Business Practices Act; and (12) and unjustly enriches Apple.
Apple brought the present motion to dismiss on December 8, 2023, and the motion is fully

24
25

briefed. Opposition to Motion to Dismiss (“Opp.”), ECF 124; Reply in Support of Motion to

26

Dismiss (“Reply”), ECF No. 126. The Court heard oral argument on the motion on March 21,

27

2024.

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
3

United States District Court
Northern District of California

1

II.

LEGAL STANDARDS

2

Federal Rule of Civil Procedure 8(a) requires a plaintiff to plead each claim with sufficient

3

specificity to “give the defendant fair notice of what the ... claim is and the grounds upon which it

4

rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotations omitted).

5

Although particular detail is not generally necessary, the factual allegations “must be enough to

6

raise a right to relief above the speculative level” such that the claim “is plausible on its face.” Id.

7

at 555, 570. A complaint which falls short of the Rule 8(a) standard may be dismissed if it fails to

8

state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). Dismissal of a claim

9

under Rule 12(b)(6) may be based on a “lack of a cognizable legal theory or the absence of

10

sufficient facts alleged under a cognizable legal theory.” Balistreri v. Pacifica Police Dep’t, 901

11

F.2d 696, 699 (9th Cir. 1988) (internal citation omitted); see Ministerio Roca Solida v. McKelvey,

12

820 F.3d 1090, 1096 (9th Cir. 2016).

13

To contest a plaintiff’s showing of subject matter jurisdiction, a defendant may file a Rule

14

12(b)(1) motion. Fed. R. Civ. P. 12(b)(1). A defendant may challenge jurisdiction “facially” by

15

arguing the complaint “on its face” lacks jurisdiction or “factually” by presenting extrinsic

16

evidence demonstrating the lack of jurisdiction on the facts of the case. Wolfe v. Strankman, 392

17

F.3d 358, 362 (9th Cir. 2004); Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.

18

2004). “In a facial attack, the challenger asserts that the allegations contained in a complaint are

19

insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the

20

challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal

21

jurisdiction.” Safe Air for Everyone, 373 F.3d at 1039.

22

In resolving a factual attack on jurisdiction, the Court may review evidence beyond the

23

complaint without converting the motion to dismiss into a motion for summary judgment. Id.

24

(citing Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039

25

n.2 (9th Cir. 2003)). While the Court may consider evidence outside of the pleadings to resolve a

26

“factual” Rule 12(b)(1) motion, “a [j]urisdictional finding of genuinely disputed facts is

27

inappropriate when the jurisdictional issue and substantive issues are so intertwined that the

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
4

1

question of jurisdiction is dependent on the resolution of factual issues going to the merits of an

2

action.” Safe Air for Everyone, 373 F.3d at 1039 n.3 (citing Sun Valley Gasoline, Inc. v. Ernst

3

Enters., Inc., 711 F.2d 138, 140 (9th Cir. 1983)) (internal quotation marks omitted).

United States District Court
Northern District of California

4

Claims that sound in fraud are further subject to a heightened pleading standard. Fed. R.

5

Civ. Proc. 9(b) (“In alleging fraud or mistake, a party must state with particularity the

6

circumstances constituting fraud or mistake.”); Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097,

7

1103–04 (9th Cir. 2003) (recognizing that claims “grounded in fraud” or which “sound in fraud”

8

must meet the Rule 9(b) pleading standard, even if fraud is not an element of the claim). The

9

allegations must be “specific enough to give defendants notice of the particular misconduct which

10

is alleged to constitute the fraud charged so that they can defend against the charge and not just

11

deny that they have done anything wrong.” Semegen v. Weidner, 780 F.2d 727, 731 (9th Cir.

12

1985). This requires an account of the “time, place, and specific content of the false

13

representations as well as the identities of the parties to the misrepresentations.” Swartz v. KPMG

14

LLP, 476 F.3d 756, 764 (9th Cir. 2007) (quoting Edwards v. Marin Park, Inc., 356 F.3d 1058,

15

1066 (9th Cir. 2004)). In other words, fraud or claims asserting fraudulent conduct must generally

16

contain more specific facts than is necessary to support other causes of action. That said, with

17

respect to omissions-based fraud claims, “the pleading standard is lowered on account of the

18

reduced ability in an omission suit ‘to specify the time, place, and specific content, relative to a

19

claim involving affirmative misrepresentations.’” Barrett v. Apple Inc., 2021 WL 827235, at *7

20

(N.D. Cal. Mar. 4, 2021) (quoting In re Apple & AT&T Mobility Antitrust Litig., 596 F. Supp. 2d

21

1288, 1310 (N.D. Cal. 2008)).

22

At the motion to dismiss stage, the Court must read and construe the complaint in the light

23

most favorable to the non-moving party. Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th

24

Cir. 1996). Additionally, the Court must accept as true all “well-pleaded factual allegations.”

25

Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). However, “courts are not bound to accept as true a

26

legal conclusion couched as a factual allegation.” Twombly, 550 U.S. at 555. Nor is a complaint

27

sufficient if it merely “tenders naked assertions devoid of further factual enhancement.” Iqbal,

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
5

United States District Court
Northern District of California

1

556 U.S. at 678 (internal quotation marks omitted). “In all cases, evaluating a complaint’s

2

plausibility is a ‘context-specific’ endeavor that requires courts to draw on ... judicial experience

3

and common sense.” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (quoting Starr v.

4

Baca, 652 F.3d 1202, 1216 (9th Cir. 2011)). When deciding whether to grant a motion to dismiss,

5

the Court generally “may not consider any material beyond the pleadings.” Hal Roach Studios,

6

Inc. v. Richard Feiner & Co., 896 F.2d 1542, 1555 n.19 (9th Cir. 1990). However, the Court may

7

consider material submitted as part of the complaint or relied upon in the complaint, and may also

8

consider material subject to judicial notice. See Lee v. City of Los Angeles, 250 F.3d 668, 688–89

9

(9th Cir. 2001); Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)

10

(holding the court is “not required to accept as true conclusory allegations which are contradicted

11

by documents referred to in the complaint.”).

12

If a motion to dismiss is granted, “leave to amend should be granted ‘unless the court

13

determines that the allegation of other facts consistent with the challenged pleading could not

14

possibly cure the deficiency.’” DeSoto v. Yellow Freight Sys., 957 F.2d 655, 658 (9th Cir. 1992)

15

(quoting Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986)).

16

Leave to amend may also be denied if allowing amendment would unduly prejudice the opposing

17

party, cause undue delay, or be futile, or if the moving party has acted in bad faith. See

18

Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532 (9th Cir. 2008).

19

III.

REQUEST FOR JUDICIAL NOTICE

20

Apple has submitted eighteen exhibits that it asks the Court to review in ruling on its

21

motion to dismiss. Apple’s Request for Judicial Notice (“RJN”), ECF 123; id. at Exs. 1–18.

22

Apple argues these exhibits are either incorporated by reference by the complaint or subject to

23

judicial notice. Plaintiffs oppose Apple’s request. See ECF No. 125.

24

There are two doctrines that permit district courts to consider material outside the

25

pleadings without converting a motion to dismiss into a motion for summary judgment: judicial

26

notice under Federal Rule of Evidence 201 and incorporation by reference. Khoja v. Orexigen

27

Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018). The judicial notice doctrine permits a court

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
6

United States District Court
Northern District of California

1

to take judicial notice of matters that are “not subject to reasonable dispute.” Fed. R. Evid. 201(b).

2

A fact is “not subject to reasonable dispute” if it is “generally known,” or “can be accurately and

3

readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid.

4

201(b)(1)–(2). However, “[j]ust because the document itself is susceptible to judicial notice does

5

not mean that every assertion of fact within that document is judicially noticeable for its truth.”

6

Khoja, 899 F.3d at 999. For instance, though public records are generally subject to judicial

7

notice, a court may not take judicial notice of disputed facts within public records. Id.

8

“[I]ncorporation-by-reference is a judicially created doctrine that treats certain documents

9

as though they are part of the complaint itself.” Khoja, 899 F.3d at 1002. This doctrine permits a

10

court to consider a document “if the plaintiff refers extensively to the document or the document

11

forms the basis of the plaintiff’s claim.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir.

12

2003). A court generally “may assume an incorporated document’s contents are true for purposes

13

of a motion to dismiss under Rule 12(b)(6).” Khoja, 899 F.3d at 1003 (internal quotations

14

omitted). Because all inferences must still be drawn in the nonmoving party’s favor, however, “it

15

is improper to assume the truth of an incorporated document if such assumptions only serve to

16

dispute facts stated in a well-pleaded complaint.” Id.

17
18

Having reviewed the basic principles of judicial notice and incorporation by reference, the
Court turns to each of the documents Apple has submitted.

19

A.

20

Exhibits 1 and 2 are the iOS and iPadOS 16 Software License Agreement and watchOS 9

Exhibits 1–3

21

Software License Agreement, which govern use of certain technology Plaintiffs claim to have

22

used. Exhibit 3 is a copy of the Privacy Policy referred to in the complaint. These documents

23

“form the basis” for Plaintiffs’ claims for breach of contract, implied contract, and implied

24

covenant of good faith and fair dealing claims, as they contain the contract terms that were

25

allegedly breached. See CAC ¶¶ 103–14, 122–24, 134. Apple’s request to incorporate by

26

reference the software license agreements and Privacy Policy is therefore GRANTED. See

27

Ritchie, 342 F.3d at 908.

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
7

1

B.

Exhibits 4–8

Exhibits 4–8 are copies of the “welcome screen” that are shown the first time a user opens

2
the Apple Apps at issue in this case. See Ex. 4 (welcome screen for App Store); Ex. 5 (welcome
3
screen for Apple Music); Ex. 6 (welcome screen for Apple TV); Ex. 7 (welcome screen for
4
Books); Ex. 8 (welcome screen for Stocks). Apple states that these welcome screens reflect
5
6

Apple’s representations about its privacy practices and privacy settings, which are “integral to
plaintiffs’ claims and are incorporated by reference.” RJN 3.

7
Although Exhibits 4–8 are not referred to extensively in the complaint, the Court finds they
8
9

are appropriately incorporated by reference because the welcome screens form the basis Plaintiffs’
claim. Ritchie, 342 F.3d at 908. Plaintiffs’ claims each relate to whether Apple disclosed its

10
collection practices and whether Plaintiffs consented to those collection practices. See, e.g., CAC

United States District Court
Northern District of California

11
12
13
14

¶¶ 110 (“[d]espite promising Plaintiffs and the Class that their user data would not be
collected…”), 122 (referring to Apple’s “disclosures” which created an implied contract “that
Apple would not collect and store user data” under certain circumstances).
Apple’s request to incorporate by reference the welcome screens is therefore GRANTED.

15
16

C.

Exhibits 9–14, 18

Exhibits 9–14 and 18 are copies of various Apple privacy disclosures. See Ex. 9 (App
17
Store & Privacy disclosure), Ex. 10 (Apple Music & Privacy disclosure), Ex. 11 (Apple TV App
18
& Privacy disclosure), Ex. 12 (Apple Books & Privacy disclosure), Ex. 13 (Stocks & Privacy
19
disclosure), Ex. 14 (Device Analytics & Privacy disclosure), Ex. 18 (Family Privacy Disclosure
20
for Children).
21
The various Apple privacy disclosures are available on public websites. See Opperman v.
22

Path, Inc., 205 F. Supp. 3d 1064, 1068 n.3 (N.D. Cal. 2016) (judicially noticing “the Yelp Privacy

23
Policies during the relevant time periods because they were publicly available on the Yelp
24
25
26

website”); see also In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1025, 1028–29 (N.D. Cal. 2014)
(judicially noticing Yahoo’s Terms of Service ansd Privacy Policy “because they are aspects of a
publicly accessible website”). Apple’s request that the Court judicially notice the privacy

27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
8

1

disclosures is therefore GRANTED.

2

D.

3

Finally, Exhibits 15–17 are copies of certain setting screens. Ex. 15 (Share [Device]

4

Analytics setting), Ex. 16 (Allow Apps to Request to Track setting), Ex. 17 (tracking setting

5

disclosure). As with Exhibits 4–8, the Court finds that these Exhibits form the basis of Plaintiffs’

6

claims because the Exhibits reflect the settings Plaintiffs contend they adjusted to protect their

7

privacy. See, e.g., CAC ¶ 44.
Apple’s request to incorporate by reference the setting screens is therefore GRANTED.

8

United States District Court
Northern District of California

9

Exhibits 15–17

IV.

DISCUSSION

10

Plaintiffs bring twelve counts against Apple for (1) breach of contract; (2) breach of

11

implied contract; (3) breach of the implied covenant of good faith and fair dealing; (4) invasion of

12

privacy under California’s Constitution; (5) violation of California’s Invasion of Privacy Act

13

(“CIPA”); (6) violation of California’s Unfair Competition Law (“UCL”); (7) violation of

14

Pennsylvania’s Wiretapping and Electronic Surveillance Act (“WESCA”); (8) violations of New

15

York Gen. Bus. Law (“GBL”) § 349; (9) violation of New York GBL § 350; (10) violation of

16

New Jersey’s Consumer Fraud Act (“NJCFA”); (11) violations of Illinois’s Consumer Fraud and

17

Deceptive Business Practices Act (“ICFDA”); and (12) unjust enrichment.

18

Apple moves to dismiss the complaint on several grounds. First, Apple raises two

19

threshold arguments: that Plaintiffs’ failure to allege facts about their own experiences warrants

20

dismissal for lack of Article III standing and failure to state a claim, and Plaintiffs’ consent to the

21

data collection defeats their claims. Second, Apple contends that Plaintiffs’ contract claims are

22

deficient because Plaintiffs cannot establish any breach and have not plausibly plead damages.

23

Third, Apple argues that the complaint does not plausibly allege a wiretap or privacy claim.

24

Fourth, Apple moves to dismiss Plaintiffs’ state-law consumer protection claims because Plaintiffs

25

have not adequately alleged a fraudulent statement or deceptive act. Finally, Apple argues that the

26

Court lacks equitable jurisdiction to hear the UCL and unjust enrichment claims. The Court

27

addresses each ground in turn below.

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
9

1

United States District Court
Northern District of California

2

A.

Threshold Arguments
1.

Standing

3

Apple first argues that Plaintiffs’ claims should be dismissed for lack of Article III

4

standing and under Rule 12(b)(6) because Plaintiffs have not alleged what data was collected from

5

them or any facts about the collection practices of apps beyond those in Plaintiffs’ class definition.

6

Mot. 7–9. Apple also contends that the minor Plaintiffs do not allege what apps they used. Id. at

7

8. Plaintiffs respond that Jones v. Ford Motor Co., 85 F.4th 570 (9th Cir. 2023) disposes of

8

Apple’s argument. Opp. 4. In that decision, the Ninth Circuit found that plaintiffs who brought

9

claims under the Washington Privacy Act had alleged Article III standing where the operative

10

class action complaint included allegations that Ford vehicles’ system “downloads all text

11

messages and call logs from Plaintiffs’ cellphones as soon as they are connected,” and “the

12

infotainment system permanently stores the private communications without Plaintiffs’ knowledge

13

or consent.” Id. at 574. These allegations, the court found, “plausibly articulate an Article III

14

injury because they claim violation of a substantive privacy right.” Id. (explaining that “[a] statute

15

that codifies a common law privacy right gives rise to a concrete injury sufficient to confer

16

standing”) (quotations omitted).

17

So too here. The complaint includes allegations that Apple violated a substantive privacy

18

right, including California’s Invasion of Privacy Act. Plaintiffs allege that Apple “accessed and

19

recorded” Plaintiffs’ data while they were using certain apps, and Plaintiffs “never consented to

20

Apple tracking [their] data while” certain settings were turned off. See, e.g., CAC ¶ 11. At this

21

stage, as in Jones, the allegations plausibly articulate an Article III injury because they claim

22

violation of a substantive privacy right.

23

Apple further argues that even if Plaintiffs have Article III standing, the complaint should

24

nevertheless be dismissed for failure to state a claim because the complaint lacks factual

25

allegations about what data was collected from Plaintiffs. The Court declines to find that, as a

26

threshold matter and without evaluating the pleading requirements for each claim, Plaintiffs’

27

claims are insufficient to state a claim under Rule 12(b)(6). Indeed, the cases Apple relies on to

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
10

1

seek a complaint-wide dismissal made no blanket ruling but rather considered the requirements of

2

each claim. Mot. 8–9; In re Google Assistant Privacy Litigation, 457 F. Supp. 3d 797, 810–11,

3

817 (N.D. Cal. 2020) (evaluating counts separately); see also In re Google Location Hist. Litig.,

4

428 F. Supp. 3d 185, 199 (N.D. Cal. 2019) (same). Given the differing legal requirements for

5

each claim, the Court will consider the sufficiency of Plaintiffs’ allegations as to each set of claims

6

as opposed to on a complaint-wide basis.

7

2.

8

In its next threshold argument for dismissing the complaint, Apple contends that Plaintiffs

9

agreed to the collection of any Apple App data collections through Apple’s Privacy Policy, which

10

defeats all claims. Mot. 9–10.
Consent is a defense to Plaintiffs’ claims.1 See Hill v. Nat’l Collegiate Athletic Ass’n, 7

11

United States District Court
Northern District of California

Consent

12

Cal. 4th 1, 26 (1994) (plaintiff “must not have manifested by his or her conduct a voluntary

13

consent” to alleged privacy violation); Smith v. Facebook, Inc., 262 F. Supp. 3d 943, 954 (N.D.

14

Cal. 2017), aff’d 745 F. App’x 8 (9th Cir. 2018) (plaintiffs’ consent barred CIPA, privacy, and

15

implied covenant claims); Silver v. Stripe, Inc., 2021 WL 3191752, at *4–5 (N.D. Cal. July 28,

16

2021) (user consent is defense under CIPA); Hicks v. PGA Tour, Inc., 897 F.3d 1109, 1120 n.6

17

(9th Cir. 2018) (affirming dismissal of unjust enrichment claim based on consent); Hassler v.

18

Sovereign Bank, 374 F. App’x 341, 344 (3d Cir. 2010) (NJCFA claim failed where account

19

agreement “clearly explained” the challenged actions); 18 Pa. C.S. § 5704(4) (WESCA permits

20

collection with the parties’ “prior consent”); Chen v. Dunkin’ Brands, Inc., 954 F.3d 492, 501 (2d

21

Cir. 2020) (explaining that “there can be no [GBL] claim when the allegedly deceptive practice

22

was fully disclosed”).
By assenting to the software license agreement, which incorporates Apple’s Privacy

23
24

Policy, and then proceeding to use Apple Apps, Apple argues Plaintiffs consented to the data

25
26
27
28

Apple has not identified authority showing that consent is a defense to Plaintiffs’ ICFDA claims.
Accordingly, any ruling as to consent will not apply to Plaintiffs’ ICFDA claim. Apple may raise
the issue in a future motion to dismiss where applicable.
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
11
1

1

collection they now complain of. To use their devices, Plaintiffs were required to agree to the

2

relevant software license. See RJN Ex. 1 at 1 (“BY USING YOUR DEVICE . . . YOU ARE

3

AGREEING TO BE BOUND BY THE TERMS OF THIS LICENSE.”); RJN Ex. 2 (watchOS

4

Software License) at 1 (same). The software licenses incorporate Apple’s Privacy Policy.

5

CAC ¶ 103.

6
7
8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

Apple’s Privacy Policy, which “incorporates the mobile device’s settings into the terms of
the parties’ agreement” (CAC ¶ 103), discloses the following:
When you create an Apple ID, apply for commercial credit, purchase and/or
activate a product or device, download a software update, register for a class at an
Apple Store, connect to our services, contact us (including by social media),
participate in an online survey, or otherwise interact with Apple, we may collect a
variety of information[.]
Id. ¶ 134 (quoting Apple’s Privacy Policy) (emphasis in complaint).
The Privacy Policy also states that Apple may collect “usage data,” which Apple defines as
“[d]ata about your activity on and use of our offerings, such as app launches within our services,
including browsing history; search history; product interaction; crash data, performance and other
diagnostic data; and other usage data.” RJN Ex. 3 (“Privacy Policy”). According to the Privacy
Policy, Apple may also collect “device information,” which Apple defines as “[d]ata from which
your device could be identified, such as device serial number, or about your device, such as
browser type. Id. For apps that provide media services––App Store, TV, Music, iTunes, Books,
and Stocks––Apple collects additional data “to support the experiences users expect from these
services.” Mot. 10 (citing Privacy Policy). These apps provide additional disclosures when a user
first opens that specific app. Below is an example of one of these “welcome screen” disclosures
for the App Store. At the bottom of the screen, the disclosure states: “Your searches, browsing,
purchases, and device trust score may be used to personalize your experience, send you
notifications including for Apple marketing, improve the store, and prevent fraud.” The disclosure
then provides a link stating: “See how your data is managed,” which when clicked, directs the user
to additional disclosures about Apple’s data collection.

27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
12

1
2
3
4
5
6
7
8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20

RJN Ex. 4.
Consent “can be explicit or implied, but any consent must be actual.” In re Meta Pixel

21

Healthcare Litig., 647 F. Supp. 3d 778, 793 (N.D. Cal. 2022) (quoting In re Google, Inc., No. 13-

22

MD-02430, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013)). “In order for consent to be

23

actual, the disclosures must ‘explicitly notify’ users of the practice at issue.” Id. In determining

24

consent, courts consider “whether the circumstances, considered as a whole, demonstrate that a

25

reasonable person understood that an action would be carried out so that their acquiescence

26

demonstrates knowing authorization.” Calhoun v. Google, LLC, No. 22-16993, 2024 WL

27

3869446, at *5 (9th Cir. Aug. 20, 2024) (quoting Smith, 745 F. App’x at 8). If a user could have

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
13

1

plausibly understood the disclosures “as not disclosing that [the defendant] would engage in

2

particular conduct,” then the disclosures are insufficient to establish consent. Id.

United States District Court
Northern District of California

3

The Court finds that Apple sufficiently disclosed the challenged data collection in both the

4

Privacy Policy and then subsequently in the welcome screen disclosures. Plaintiffs allege that

5

Apple collected (1) “what was tapped on, which Apps were searched for, what ads were displayed,

6

how long an app was viewed, and how the app was found” (CAC ¶ 52); (2) “details about a user’s

7

mobile device . . . , including device identification numbers, what kind of device was used, the

8

device’s screen resolution, the device’s keyboard language, and how the user was connected to the

9

internet” (id.); and (3) “a ‘Directory Services Identifier’ that is tied to a mobile device user’s

10

iCloud account, and links their name, email address, and more to the harvested user data” (id.

11

¶ 55). The Privacy Policy discloses that Apple collects this very information. It explains that the

12

App Store collects (or “logs”) the following:

13

•

Information “about your usage of the stores, including when you open or close the App

14

Store, what content you search for, [and] the content you view and download” (RJN

15

Ex. 9 at 2);

16

•

Information related to “what you’ve previously searched for, viewed, downloaded,
updated, or reviewed in the App Store” (id.);

17
18

•

“[I]dentifiers such as your device’s hardware ID and IP address” (id. at 1);

19

•

“[T]ype of device, the version of your operating system, system, and the amount of free
space on your device” (id. at 2);

20
21

•

“[I]nformation about your browsing, purchases, searches, and downloads. These

22

records may be stored with IP address, a random unique identifier (where that arises),

23

and Apple ID when you are signed in to the App Store or other Apple online stores”

24

(id. at 1).

25

Additionally, the welcome screens for each Apple App again disclose to users that “Your

26

searches, browsing, purchases, and device trust score may be used to personalize your experience,

27

send you notifications including for Apple marketing, improve the store, and prevent fraud.” See,

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
14

1

United States District Court
Northern District of California

2

e.g., RJN Ex. 4.
These combined disclosures are sufficient to establish that by using their devices,

3

Plaintiffs, and “a reasonable person viewing those disclosures[,] would understand” and be on

4

notice that Apple engaged in the contested data collection practices. Smith, 745 F. App’x at 8.

5

“Courts consistently hold that terms of service and privacy policies, like [Apple’s] privacy policy

6

here, can establish consent to the alleged conduct challenged under various states wiretapping

7

statutes and related claims.” Silver, 2021 WL 3191752, at *4 (privacy policy which included

8

provisions that disclose that parties may obtain various data provided sufficient notice of data

9

collection).

10

Plaintiffs do not dispute they received sufficient notice of the collection. Rather, they

11

contend that the software licenses disclosing the data collection are not part of the complaint.

12

Opp. 6. The Court takes judicial notice of the software licenses for the reasons stated above. See

13

supra Part III. Plaintiffs next respond that, even if the Privacy Policy and other notices disclose

14

the collection at issue, any disclosure is modified by the statement in the same policy which

15

permits users to withdraw their consent. Opp. 7 (citing CAC ¶ 48 (“Where you are requested to

16

consent to the processing of your personal data by Apple, you have the right to withdraw your

17

consent at any time”)). And by disabling the “Allow Apps to Request to Track” and the “Share

18

[Device] Analytics” settings, Plaintiffs assert that it was not unreasonable for them to assume this

19

effectively withdrew consent to have Apple collect the contested data. Id. The Court will evaluate

20

both settings in turn below.

21
a.
22
23

“Allow Apps to Request to Track” Setting

As shown below, by enabling the “Allow Apps to Request to Track” setting, a user will
“[a]llow apps to ask to track your activity across other companies’ apps and websites.”

24
25
26
27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
15

1
2
3
4
5
6
7
8
9
10

United States District Court
Northern District of California

11

RJN Ex. 16.
By disabling the “Allow Apps to Request to Track” setting, “all new app tracking requests

12

are automatically denied.” Id. This setting clearly applies to “activity across other companies’

13

apps and websites”––by its plain language, the setting does not impact Apple’s tracking activity

14

across Apple Apps and websites. In other words, turning “off” the “Allow Apps to Request to

15

Track” setting would not result in automatic denial of all new app tracking requests pertaining to

16

activity across Apple’s Apps; only activity across third party apps and websites. Additionally, by

17

clicking on the “Learn more” link beneath the setting, users are presented with a disclosure titled

18

“Tracking” (shown below) which states that “Apple requires app developers to ask for permission

19

before they track your activity across apps or websites they don’t own in order to target advertising

20

to you, measure your actions due to advertising, or to share your information with data brokers.”

21

RJN Ex. 17 (emphasis added).

22
23
24
25
26
27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
16

1
2
3
4
5
6
7
8

United States District Court
Northern District of California

9

CAC ¶ 105.

10

Again, Apple notifies users that this setting relates to permission for app developers to

11

track users’ activity “across apps or websites [the app developers] don’t own.” This statement

12

makes clear that the setting would not apply to Apple’s tracking of users’ activity across apps that

13

Apple owns.

14

Despite this straightforward description of the setting’s function, Plaintiffs contend that

15

they believed disabling the setting would apply to Apple Apps. However, Plaintiffs do not explain

16

why a reasonable person, reading the statements in the “Allow Apps to Request to Track” setting,

17

would believe that turning the setting off would withdraw their consent to Apple’s collection of

18

data from Apple Apps. Plaintiffs merely argue that whether users could plausibly believe they

19

were withdrawing their consent is highly factual and better reserved for a later stage. The Court

20

finds that Plaintiffs’ interpretation of the “Allow Apps to Request to Track” setting is implausible.

21

That setting lets users choose whether apps can ask permission to track them across apps or

22

websites owned by other companies—it does not affect data collection in Apple Apps that is not

23

used to track users across other companies’ sites.

24

Plaintiffs only challenge Apple’s collection and tracking of their data while using Apple

25

Apps. “[T]ak[ing] into account the level of sophistication attributable to the general public, which

26

uses [Apple’s] services,” the “Allow Apps to Request to Track” setting unambiguously governs

27

tracking of data not at issue here. Calhoun v. Google, LLC, 2024 WL 3869446, at *9.

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
17

1

Accordingly, even viewing the setting in the light most favorable to Plaintiffs, Plaintiffs’ claim

2

that they withdrew consent to the data collection at issue by turning off the “Allow Apps to

3

Request to Track” setting is facially implausible, as that setting plainly does not govern the data

4

collection Plaintiffs challenge here.

5
6
7

b.

“Share [Device] Analytics” Setting

The “Share [Device] Analytics” setting, shown below, allows a user to control whether to
share with Apple certain “Device Analytics” data.

8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

RJN Ex. 15.
Beneath the option to “Share iPhone Analytics” is a statement that reads: “Help Apple

26

improve its products and services by automatically sending daily diagnostic and usage data. Data

27

may include location information. Analytics uses wireless data.” Id. at 1. The setting provides a

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
18

1

hyperlink where users can review another disclosure “[a]bout Analytics & Privacy.” Id. The

2

linked disclosure states, among other things, “[a]nalytics is designed to protect your information

3

and enable you to choose what you share” and “iPhone Analytics may include details about

4

hardware and operating system specification, performance statistics, and data about how you use

5

your devices and applications.” RJN Ex. 14 at 1. Plaintiffs allege that they “never consented to

6

Apple tracking” their “confidential communications” while the “Share [Device] Analytics” setting

7

was disabled. See, e.g., CAC ¶ 11.
Apple argues that the “Share [Device] Analytics” setting concerns collection of technical

United States District Court
Northern District of California

8
9

performance data, such as data about app crashes or file compression effectiveness, and the

10

disclosure’s explanation of “Device Analytics” contradicts Plaintiffs’ theory.2 Mot. 13–14.

11

Viewing the setting in the light most favorable to Plaintiffs, the Court cannot say that a reasonable

12

user reading the “Share [Device] Analytics” setting must have understood that it did not control

13

the data collection Plaintiffs complain of. The linked disclosure broadly states that iPhone

14

Analytics “may include” “data about how you use your devices and applications.” The disclosure

15

also states that “[y]ou may choose to disable the sharing of Device Analytics altogether.” It is

16

plausible that a user reading this believed that by disabling the sharing of Device Analytics

17

altogether, the user would no longer share, and Apple would no longer collect, “data about how

18

[the user uses their] devices and applications.” Unlike the “Allow Apps to Request to Track”

19

setting, the “Share [Device] Analytics” setting is reasonably susceptible to more than one

20

interpretation. At this stage, giving Plaintiffs the benefit of all reasonable inferences, Plaintiffs

21

have plausibly alleged they believed they withdrew consent to the contested data collection by

22

disabling the “Share [Device] Analytics” setting. See In re Google Assistant Priv. Litig., 457 F.

23

Supp. 3d 797, 823 (N.D. Cal. 2020) (quoting In re Facebook, Inc., Consumer Priv. User Profile

24
25
26
27
28

Apple also argues that Plaintiffs’ purported understanding of these settings “defies common
sense” because Apple Apps need certain data to provide the services and experiences users expect.
Reply 6. At this stage, the Court declines to find that it would defy common sense for Plaintiffs to
interpret the “Share [Devices] Analytics” setting as an opportunity to withdraw consent to the data
collection at issue. Details regarding the type and scope of data collected can be addressed at a
later stage.
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
19
2

1

Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019) (where “the contract language at issue is

2

reasonably susceptible to more than one interpretation, with one of those interpretations

3

suggesting consent and another belying it, the Court cannot decide the consent issue in

4

[Defendants’] favor”).
* * *

United States District Court
Northern District of California

5
6

The Court finds that Apple sufficiently disclosed the challenged data collection through the

7

Privacy Policy and then subsequently in the welcome screen disclosures. However, Plaintiffs have

8

plausibly alleged that they believed turning off the “Share [Device] Analytics” setting effectively

9

withdrew their consent to challenged data collection––data about how Plaintiffs interact with

10

Apple Apps. Plaintiffs have not plausibly alleged that the “Allow Apps to Request to Track”

11

setting withdrew their consent. Accordingly, to the extent Plaintiffs’ claims are based exclusively

12

on the “Allow Apps to Request to Track” setting, the Court GRANTS Apple’s motion to dismiss

13

because Plaintiffs consented to the data collection. To the extent Plaintiffs’ claims are based on

14

the “Share [Device] Analytics” setting, the Court DENIES Apple’s motion to dismiss because,

15

although Apple disclosed the collection at issue, Plaintiffs plausibly alleged they withdrew their

16

consent by turning off that setting.

17

B.

18

Apple moves to dismiss Plaintiffs’ contract claims on several grounds. First, Apple

19

contends Plaintiffs’ breach of contract, implied contract, and implied covenant claims fail because

20

Plaintiffs do not plead breach or damages. Second, Apple moves to dismiss the implied contract

21

and unjust enrichment claims because Plaintiffs allege that an express contract governs. Third,

22

Apple argues the implied covenant claim also fails because Plaintiffs do not allege that Apple

23

unfairly prevented them from receiving a contracted-for benefit. Finally, Apple moves to dismiss

24

the unjust enrichment claim because Plaintiffs do not allege any unjust act.

25
26

Contract Claims

1.

Breach

To plead a claim for breach of contract, Plaintiffs must allege: (1) the existence of a

27

contract with Apple, (2) their performance under that contract, (3) Apple breached that contract,

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
20

1

and (4) they suffered damages. In re Google Assistant Priv. Litig., 457 F. Supp. 3d at 831.

2

Plaintiffs allege that Apple breached the Privacy Policy and Family Disclosure through promises

3

made via Apple’s settings. CAC ¶¶ 11–25, 103–14. Specifically, Apple allegedly breached the

4

Privacy Policy and Family Disclosure based on Apple’s “explicit promises” identified in Apple’s

5

settings that (1) refusing to “Allow Apps to Request to Track” would ensure that “all apps […]

6

will be blocked from accessing the device’s Advertising Identifier[;]” (2) disabling “Share

7

[Device] Analytics” would prevent Apple from “sending daily diagnostic and usage data[;]”and

8

(3) Apple would “not knowingly collect, use, or disclose any personal information from your child

9

without your verifiable parental consent unless a COPPA exception applies.” Opp. 10 (citing

10

United States District Court
Northern District of California

11

CAC ¶¶ 32–49, 103–13).
At the outset, Plaintiffs’ breach of contract claim assumes that Apple’s Privacy Policy

12

“incorporates the mobile device’s settings into the terms of the parties’ agreements.” CAC ¶ 102.

13

Apple argues that the excerpted quote from the Privacy Policy which Plaintiffs rely on

14

incorporates “the welcome screens and service-specific disclosures shown the first time a user

15

opens an app,” and not “the state of a user’s settings.” Mot. 14–15. But at this stage, the Court

16

declines to interpret the Privacy Policy in favor of Apple.

17

Next, assuming the Privacy Policy incorporates the settings as pleaded, the Court turns to

18

the individual alleged breaches. In connection with Apple’s “Allow Apps to Request to Track”

19

setting, Plaintiffs allege Apple breached its promise that it “requires app developers to ask for

20

permission before they track your activity across Apps or websites they don’t own” by

21

“continuing to collect user data whenever Plaintiffs and the Class interacted with Apple’s Apps.”

22

CAC ¶ 110. As explained above, Apple established the record supports finding that Plaintiffs

23

consented to the complained of data collection, and Plaintiffs have not plausibly alleged they

24

withdrew consent by turning off the “Allow Apps to Request to Track” setting because that setting

25

unambiguously applies only to tracking of activity across Apps or websites which app developers

26

“don’t own”––tracking Plaintiffs do not challenge here. Accordingly, Plaintiffs have not plausibly

27

stated a claim for breach of contract claim based on breach of the “Allow Apps to Request to

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
21

1

Track” setting. Although skeptical, the Court cannot determine that amendment would be futile

2

and will give Plaintiffs an opportunity to amend.

United States District Court
Northern District of California

3

Next, Plaintiffs argue that Apple breached its promise set forth in the “Share [Device]

4

Analytics” setting, which states: “Help Apple improve its products and services by automatically

5

sending daily diagnostic and usage data. Data may include location information.” CAC ¶ 107. By

6

promising that disabling the setting would prevent Apple from “sending daily diagnostics and

7

usage data,” but collecting the usage data nevertheless, Apple purportedly breached its promise.

8

Apple argues that disclosure relating to non-personal Device Analytics data cannot plausibly be

9

interpreted to extend to all data collected by the apps to provide the content and services they

10

offer. While Apple’s interpretation of the “Share [Device] Analytics” setting may be the more

11

realistic interpretation, the Court cannot determine that Plaintiffs’ interpretation is implausible. At

12

this stage, Plaintiffs have adequately alleged that Apple breached its promise in the “Share

13

[Device] Analytics” setting, which Plaintiffs understood disabling would prevent Apple’s

14

collection of certain usage data.

15

Plaintiffs’ final theory of breach is based on Apple’s Family Disclosure, which applies

16

only to minors under the age of 13. RJN Exs. 3, 18. The complaint fails to allege the ages of the

17

two minor Plaintiffs. Thus, although Plaintiffs submit in opposing Apple’s Motion that the minors

18

are both under 13 years old, there is no factual basis in the complaint to conclude that Apple

19

breached any promise that applied to the minor Plaintiffs. In opposing Apple’s motion, Plaintiffs

20

also assert that the minor Plaintiffs are third-party beneficiaries of the Family Disclosure.

21

Opp. 13. Having failed to plead any third-party beneficiary theory in the complaint, Plaintiffs

22

cannot avoid dismissal on this basis. Jajco, Inc. v. Leader Drug Stores, Inc., 2013 WL 875957, at

23

*1 (N.D. Cal. Mar. 7, 2013) (dismissing contract claim where the “complaint does not include

24

allegations that [plaintiff] is an intended third party beneficiary”).

25
26

In sum, Plaintiffs’ breach of contract theory based on the “Allow Apps to Request to
Track” setting and the Family Disclosure are both DISMISSED WITH LEAVE TO AMEND.

27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
22

2.

1

United States District Court
Northern District of California

2

Damages

Having concluded that Plaintiffs’ only cognizable theory of breach of contract is based on

3

the “Share [Device] Analytics” setting, the Court proceeds to evaluate Apple’s remaining

4

arguments applied only to that theory. Apple argues that Plaintiffs have not plausibly plead

5

“appreciable and actual damage” resulting from a breach. Mot. 15 (citing Aguilera v. Pirelli

6

Armstrong Tire Corp., 223 F.3d 1010, 1015 (9th Cir. 2000)). Plaintiffs allege nominal damages,

7

“the value of their data,” and “the premium they paid for Apple mobile devices not to be tracked.”

8

CAC ¶¶ 57–84; Opp. 15. Recent authority instructs that under California law, “inability to show

9

actual damages does not preclude recovery for breach of contract.” Raiser v. Ventura Coll. of L.,

10

488 F. App’x 219, 222 (9th Cir. 2012); see also Lundy v. Facebook Inc., 2021 WL 4503071, at *2

11

(N.D. Cal. Sept. 30, 2021) (“Nominal damages may be recovered for a breach of contract under

12

California law”). Thus, Plaintiffs have sufficiently plead damages. The Court DENIES Apple’s

13

motion to dismiss Plaintiffs’ contract claims on this basis.

14
15

3.

Implied Contract, Unjust Enrichment, and Implied Covenant Claims

Apple moves to dismiss the implied contract and unjust enrichment claims because

16

Plaintiffs contend an express contract governs the subject. “[T]here cannot be a valid, express

17

contract and an implied contract, each embracing the same subject matter, existing at the same

18

time.” Randall v. Univ. of the Pac., No. 5:20-CV-03196-EJD, 2022 WL 1720085, at *4 (N.D.

19

Cal. May 28, 2022); see also Nguyen v. Stephens Inst., 529 F. Supp. 3d 1047, 1057 (N.D. Cal.

20

2021) (“As a matter of law, a quasi-contract claim for unjust enrichment cannot lie where there

21

exists between the parties a valid express contract covering the same subject matter”) (quotations

22

omitted).

23

Thus, an implied-in-fact contract may only arise if there is no express agreement between

24

Plaintiffs and Apple. Id. Plaintiffs “may alternatively plead both a breach of contract claim and a

25

quasi-contract claim, so long as [Plaintiffs] plead[] facts suggesting that the contract may be

26

unenforceable or invalid.” Doe v. Regents of Univ. of Cal., 672 F. Supp. 3d 813, 821 (N.D. Cal.

27

2023). Plaintiffs have not done so. Rather, Plaintiffs argue that Apple’s various marketing

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
23

1

statements “combined with the express terms of the contract documents” form the basis of an

2

implied contract which Apple has breached. Opp. 14. In other words, Plaintiffs’ implied contract

3

claim relies in part on the same contractual documents underlying the breach of contract claim.

4

Thus, Plaintiffs have failed to state a claim for breach of implied contract and unjust enrichment,

5

and Apple’s motion to dismiss Plaintiffs’ breach of implied contract and unjust enrichment claim

6

is GRANTED. Those claims are DISMISSED with leave to amend.

United States District Court
Northern District of California

7

Apple further argues Plaintiffs’ implied covenant claim fails because Plaintiffs identify no

8

benefit of an express contract that Apple unfairly prevented them from receiving. Mot. 16. To

9

state a claim for breach of the implied covenant of good faith and fair dealing, “a plaintiff must

10

identify the specific contractual provision that was frustrated” by the defendant’s conduct. Perez

11

v. Wells Fargo Bank, N.A., 2011 WL 3809808, at *18 (N.D. Cal. Aug. 29, 2011). Plaintiffs allege

12

Apple “unfairly withheld the benefit of privacy” by collecting data when Apple’s customers

13

requested it refrain from such data collection. Opp. 14 (citing CAC ¶¶ 50–56).

14

Just as Plaintiffs have stated a claim for breach of contract with respect to the Apple’s

15

alleged failure to respect Plaintiffs’ withdrawal of consent through the “Share [Device] Analytics”

16

setting, Plaintiffs have stated a claim for breach of the implied covenant of good faith and fair

17

dealing for that conduct. But as with Plaintiffs’ breach of contract claim based on violation of the

18

“Allow Apps to Request to Track” setting and the Family Disclosure, Plaintiffs have not stated a

19

plausible claim for breach of the implied covenant based on that setting and the Family

20

Disclosure.

21

Accordingly, Apple’s motion to dismiss Plaintiffs’ claim for breach of the implied

22

covenant (along with the parallel claim for breach of contract) is GRANTED to the extent it is

23

based on the “Allow Apps to Request to Track” setting and the Family Disclosure. Plaintiffs are

24

permitted leave to amend.

25
26
27
28

C.

Wiretap and Privacy Claims
1.

CIPA

Count five of the complaint asserts a violation of the California Invasion of Privacy Act.
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
24

1

Cal. Penal Code §§ 630, et seq.; CAC ¶¶ 151–59. The CIPA is the California state law analogue

2

to the federal Wiretap Act, enacted in 1967 in response to “advances in science and technology

3

[that] have led to the development of new devices and techniques for the purpose of

4

eavesdropping upon private communications.” Cal. Penal Code § 630. Plaintiffs allege a

5

violation of Section 632, which prohibits “intentionally and without the consent of all parties to a

6

confidential communication, us[ing] an electronic amplifying or recording device to eavesdrop

7

upon or record the confidential communication.” Cal. Penal Code § 632(a). Apple purportedly

8

violated § 632 because it “designed, contrived and effectuated its scheme to track and record

9

consumer communications while they were browsing Apps from their device while ‘Allow Apps

United States District Court
Northern District of California

10

to Request to Track’ and/or ‘Share [Device] Analytics’ were turned off.” CAC ¶ 155.

11

Apple moves to dismiss the CIPA claim on several grounds.

12

Without consent. First, Apple argues Plaintiffs failed to satisfy the “without consent”

13

element. As to the “Allow Apps to Request to Track” setting, the Court agrees Plaintiffs have not

14

plausibly plead the data collection at issue was collected without consent for the reasons explained

15

above. But the Court declines to dismiss the CIPA claim on this basis as to the “Share [Device]

16

Analytics” setting. See supra Part IV(A)(2).

17

Device. Second, Apple argues the conclusory allegation that “Apple’s mobile applications

18

constitute an ‘amplifying or recording device’ under the CIPA” is not sufficient. CAC ¶ 157.

19

Recent decisions in this Circuit have rejected Apple’s interpretation and found that “software is a

20

device under section 632(a).” Doe v. Meta Platforms, Inc., 2023 WL 5837443, at *7 (N.D. Cal.

21

Sept. 7, 2023); see also Yockey v. Salesforce, Inc., No. 22-CV-09067-JST, 2024 WL 3875785, at

22

*7 (N.D. Cal. Aug. 16, 2024) (agreeing that “software qualifies as a device under Section 632”

23

and collecting cases). The Court finds those decisions persuasive. Plaintiffs have plausibly

24

alleged that the Apple Apps at issue in this case constitute a “device” under Section 632.

25

Communication. Third, Apple contends Plaintiffs have not adequately alleged that the

26

data collected is a “communication” within the meaning of CIPA. According to Apple, Plaintiffs

27

do not specify what actions they took in any app or what data they believe was collected from

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
25

United States District Court
Northern District of California

1

them, and so the complaint does not plausibly allege recording of a “communication.” Mot. 18.

2

As to what “communication” was recorded, Plaintiffs allege that, while browsing Apple’s Apps,

3

Apple recorded “what kind of device was used,” the device’s “screen resolution,” the device’s

4

“keyboard language,” in addition to what users “tapped on,” which Apps were “searched” for, and

5

how long an App was “viewed.” CAC ¶¶ 52–55. While certain California courts have interpreted

6

“communication” broadly to mean “the exchange of thoughts, messages or information by any

7

means” (People v. Gibbons, 215 Cal. App. 3d 1204, 1208 (1989)), more recent California

8

decisions “reflect[] an understanding that the term ‘communication’ for purposes of CIPA

9

connotes a singular conversation or exchange shared between two or more participants.” Gruber

10

v. Yelp Inc., 55 Cal. App. 5th 591, 607 (2020), as modified on denial of reh’g (Oct. 23, 2020). In

11

the Court’s view, it strains credulity to interpret “communication” for purposes of CIPA to include

12

at least some of the data collection Plaintiffs complain of here, including information regarding the

13

device’s screen resolution, keyboard language, or how the user was connected to the internet.

14

Plaintiffs cite two cases they contend support shoehorning this data into the definition of

15

“communication” for purposes of CIPA. Opp. 18 (citing In re Meta Pixel Healthcare Litig., 647

16

F. Supp. 3d at 795 and Brown v. Google LLC, 685 F. Supp. 3d 909, 934 (N.D. Cal. Aug. 7, 2023)).

17

Neither persuade the Court. Initially, neither case directly addressed nor resolved the question of

18

what constitutes a “communication” under CIPA. Rather, both evaluated whether the data

19

collected in those cases were “content” within the meaning of the Wiretap Act. But even

20

assuming those cases implicitly endorsed finding the data at issue constituted a “communication”

21

under CIPA, the allegations in those cases were unlike those here. For instance, plaintiffs in In re

22

Meta alleged that Meta intercepted electronic communications between plaintiffs and their

23

healthcare providers, including full-string URLs that contained information which revealed the

24

substance of patient communications with their health entities. In re Meta Pixel Healthcare Litig.,

25

647 F. Supp. 3d at 796 (transmitted URLs such as

26

“hartfordhospital.org/services/digestivehealth/conditions-we-treat/colorectal-small-bowel-

27

disorders/ulcerative-colitis” constituted “content” under Wiretap Act because they concern the

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
26

1

“substance of the communication”). And in Brown, plaintiffs alleged the intercepted

2

communications contained the users’ IP addresses, referers, user-agents, HTTP requests, users’

3

actions on a website, and their search queries. Brown, 685 F. Supp. 3d at 935 (referring to

4

example of full-string URL from which Google would know “that the user was searching for

5

updates on Russia’s war against Ukraine”).

6

Here, Plaintiffs’ allegations lack similar detail from which the Court can conclude the

7

alleged collection constitutes a “communication” under CIPA. Without more, Plaintiffs have

8

failed to plausibly allege the requisite recording of a communication, and Apple’s motion to

9

dismiss count five is GRANTED. Plaintiffs are permitted leave to amend. The Court need not

10

United States District Court
Northern District of California

11

evaluate Apple’s remaining arguments as to this count.
2.

WESCA

12

Count seven of the complaint asserts a violation of Pennsylvania’s Wiretapping and

13

Electronic Surveillance Control Act. WESCA prohibits the intentional interception of the contents

14

of any electronic communication (18 Pa. C.S. § 5703) and “operates in conjunction with and as a

15

supplement to the Federal Wiretap Act.” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125– 26

16

(3d Cir. 2022). Apple argues Plaintiffs’ WESCA claim should be dismissed for failing to allege

17

any of the required elements. Mot. 20. First, WESCA permits interception “where all parties to

18

the communication have given prior consent to such interception.” Having found Apple disclosed

19

the collection at issue, and Plaintiffs plausibly allege withdrawal of that consent based on the

20

“Share [Device] Analytics” setting (but not the “Allow Apps to Request to Track” setting), the

21

Court declines to dismiss the WESCA claim based on prior consent.

22

Second, Apple argues Plaintiffs have not alleged an “interception” under WESCA because

23

Apple did not obtain the “contents” of any “communication.” WESCA’s definition of “contents”

24

––“any information concerning the substance, purport, or meaning of that communication” (18 Pa.

25

C.S. § 5702)––is similar to the Wiretap Act’s definition of “contents” and the term is

26

“interpretated in the same way” in both statutes. Fraser v. Nationwide Mut. Ins. Co., 352 F.3d

27

107, 113 n.6 (3d Cir. 2003). Not included in the scope of “content” is “record” data like “basic

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
27

1

identification and address information” because this information does not constitute “the

2

substance, purport, or meaning” of communications. In re Zynga Priv. Litig., 750 F.3d 1098, 1106

3

(9th Cir. 2014) (user’s Facebook ID and the address of the webpage from which the user’s HTTP

4

request to view another webpage was sent not considered “content” under Wiretap Act). As

5

explained above in the context of whether the collected information constituted a

6

“communication” under CIPA, Plaintiffs’ allegations similarly lack sufficient detail to infer that

7

the information collected amounted to more than just “record” data. Plaintiffs allege Apple

8

intercepted “what was tapped on, which Apps were searched for, what ads were displayed, how

9

long an app was viewed, and how the app was found,” along with “details about a user’s mobile

10

device.” CAC ¶ 52.
In James v. Walt Disney, the plaintiffs alleged that Oracle intercepted “information about

United States District Court
Northern District of California

11
12

the webpages they viewed and searches they conducted.” 701 F. Supp. 3d 942, 956 (N.D. Cal.

13

Nov. 8, 2023). While recognizing that intercepting “mouse clicks and keystrokes” would likely

14

not rise to the level of “contents” under WESCA because that information does not reveal the

15

substance of any communication, the court did conclude that information about the webpages

16

plaintiffs’ viewed and searches they conducted was sufficient. Id. Here, consistent with the cases

17

interpreting WESCA’s “content” requirement, the only information that might plausibly reveal the

18

substance of any communication under WESCA is information regarding “which Apps were

19

searched for.” CAC ¶ 52. Although “[u]nder some circumstances, a user’s request to a search

20

engine for specific information” could constitute content, without more detail regarding whether

21

Plaintiffs searched for specific information, this is not one of those circumstances.3 In re Zynga

22

Priv. Litig. at 1108. The remaining collected information (e.g., what was tapped on, what ads

23

were displayed, how long an app was viewed, the device screen resolution) lacks requisite detail to

24

convince the Court that it might plausibly reveal the substance of any communication rather than

25
26
27
28

3

The Court is not suggesting that Plaintiffs are required to plead the exact Apps that were
searched for. However, Plaintiffs must plead, as in Brown and In re Meta, at least some detail to
allow the Court to evaluate the information contained in the purported intercepted communications
and whether the information is more than “record” data.
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
28

1

United States District Court
Northern District of California

2

convey “record” data WECSA does not protect.
Plaintiffs fail to adequately allege the collection of “content”––a required element to plead

3

a violation of WESCA. Accordingly, the Court GRANTS Apple’s motion to dismiss Plaintiffs’

4

WESCA claim. Plaintiffs are permitted leave to amend.

5

D.

6

Count four of Plaintiffs’ complaint asserts an invasion of privacy under California’s

Invasion of Privacy

7

Constitution. CAC ¶¶ 138–50. To state a claim for invasion of privacy under the California

8

Constitution, Plaintiffs must show that (1) they possess a legally protected privacy interest,

9

(2) they maintain a reasonable expectation of privacy, and (3) the intrusion is “so serious ... as to

10

constitute an egregious breach of the social norms” such that the breach is “highly offensive.” In

11

re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). Apple argues

12

Plaintiffs fail to plead all three elements. In evaluating the sufficiency of an invasion of privacy

13

claim, courts ask whether (1) there exists a reasonable expectation of privacy, and (2) the intrusion

14

was highly offensive. Id.

15

Apple contends Plaintiffs fail to plead a reasonable expectation of privacy because

16

(1) Plaintiffs consented to the collection, and (2) Plaintiffs cannot reasonably expect that data they

17

knowingly provide to Apple would not be received by Apple. Mot. 23. The Court rejects Apple’s

18

first argument because Plaintiffs plausibly alleged they withdrew their consent to the data

19

collection based on the “Share [Device] Analytics” setting (but not the “Allow Apps to Request to

20

Track” setting). For its second argument, Apple cites United States v. Forrester, where the Ninth

21

Circuit held that internet users “have no expectation of privacy in the to/from addresses of their

22

messages or the IP addresses of the websites they visit” because “they should know that this

23

information is provided to and used by Internet service providers for the specific purpose of

24

directing the routing of information.” 512 F.3d 500, 510 (9th Cir. 2008). In a similar vein, Apple

25

argues that reasonable consumers understand when they buy a book in the Books app, for

26

example, Apple must record the purchase to process the transaction and make the book available

27

on users’ devices. Mot. 23. The Court agrees. No reasonable consumer would expect to engage

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
29

United States District Court
Northern District of California

1

in a transaction with Apple without some data being collected from Apple to process that

2

transaction. While the Court declines to rule at this stage on which data consumers would

3

reasonably expect to be collected, as plead, the complaint has not plausibly alleged a reasonable

4

expectation of privacy. To be sure, courts in the Ninth Circuit have recognized a reasonable

5

expectation of privacy related to certain data collection. See In re Facebook, 956 F.3d at 603

6

(allegations that Facebook “collects a full-string detailed URL, which contains the name of a

7

website, folder and sub-folders on the web-server, and the name of the precise file requested”

8

sufficient to plead a reasonable expectation of privacy); In re Vizio, Inc., Consumer Priv. Litig.,

9

238 F. Supp. 3d 1204, 1232 (C.D. Cal. 2017) (plaintiffs have cognizable interest in keeping

10

“detailed data about what video content they watch private”); Brown v. Google LLC, 525 F. Supp.

11

3d 1049, 1077 (N.D. Cal. 2021) (allegations that Google collected “a complete, cradle-to-grave

12

profile of users” sufficient to plead a reasonable expectation of privacy). The allegations of

13

Apple’s data collection here fall short of those in the above cases––particularly because Plaintiffs

14

allege Apple collected data from Plaintiffs’ interactions with Apple’s own apps. Plaintiffs have

15

failed to sufficiently plead that they had any reasonable expectation of privacy in Apple’s data

16

collection, and Apple’s motion to dismiss the invasion of privacy claim is GRANTED with leave

17

to amend.4

18

E.

19

Plaintiffs allege violations of California, New York, New Jersey, and Illinois consumer

Consumer Protection Claims

20

protection laws. CAC ¶¶ 160–74 (UCL); id. ¶¶ 194–216 (GBL); id. ¶¶ 240–256 (NJCFA); id. ¶¶

21

257–281 (ICFDA). The parties agree each claim requires a fraudulent statement or deceptive act.

22

Mot. 26; Opp. 26. Because each claim sounds in fraud, Plaintiffs must meet Rule 9(b)’s

23

heightened pleading standard. Plaintiffs allege Apple misrepresented its commitment to privacy

24

and the safety of users’ data via Apple’s (1) “Allow Apps to Request to Track” and “Share

25
26
27
28

The Court need not address whether the disclosed data collection is an “egregious breach” of
social norms, but the Court is skeptical Plaintiffs have alleged sufficient factual detail regarding
the data collection at issue to rise to the requisite level.
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
30
4

1
2

United States District Court
Northern District of California

3

[Device] Analytics” settings, and (2) statements made in various Apple marketing materials.
1.

Settings

Starting with the two settings, Plaintiffs have not plausibly alleged they withdrew consent

4

by turning off the “Allow Apps to Request to Track” setting because that setting unambiguously

5

applies only to tracking of activity across Apps or websites which app developers “don’t own.”

6

Thus, any misrepresentation claims based on that setting fail because Plaintiffs only allege

7

improper collection of their data on Apple’s Apps. As to the “Share [Device] Analytics” setting,

8

Apple again argues that this setting governs certain device performance data which is not at issue

9

here. But for the reasons stated above, Plaintiffs have plausibly alleged that disabling the setting

10

would “disable the sharing of Device Analytics,” which may “include [...] data about how you use

11

your devices and applications.” CAC ¶¶ 46–47. This is sufficient to plead a misrepresentation.

12

In addition to alleging a misrepresentation, Plaintiffs must allege reliance on the statement

13

in order to plead a cause of action for fraud in California. Kearns v. Ford Motor Co., 567 F.3d

14

1120, 1126 (9th Cir. 2009). Plaintiffs have sufficiently done so. See CAC ¶ 169. Apple argues

15

that Plaintiffs have not alleged “which specific statement, advertisement, or representation they

16

viewed or when.” Reply 18. But this overlooks Plaintiffs’ allegations about the specific “Share

17

[Device] Analytics” setting, and how Plaintiffs understood that disabling the setting would de-

18

activate the data tracking feature on their phones. CAC ¶ 169. Moreover, at the motion to dismiss

19

stage, “actual reliance ... is inferred from the misrepresentation of a material fact.” Moore v. Mars

20

Petcare US, Inc., 966 F.3d 1007, 1021 (9th Cir. 2020) (quoting Friedman v. AARP, Inc., 855 F.3d

21

1047, 1055 (9th Cir. 2017)). And whether a misrepresentation is sufficiently material to allow for

22

an inference of reliance is “generally a question of fact that cannot be decided at the motion to

23

dismiss stage.” Id. Here, for the reasons stated above, it is plausible that a reasonable consumer

24

would (1) believe that disabling the “Share [Device] Analytics” setting meant Apple would not

25

collect the data at issue, and (2) rely on the “Share [Device] Analytics” setting.

26
27
28

2.

Marketing Campaign

With respect to the advertisements and other marketing statements, Plaintiffs allege that
Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
31

United States District Court
Northern District of California

1

“Apple aggressively markets that it protects privacy” and refers to billboards with statements such

2

as “Privacy. That’s iPhone,” “We’re in the business of staying out of yours,” “Privacy is King,”

3

and “Our apps mind their business. Not yours.” Under appropriate factual circumstances, a

4

representative consumer plaintiff “may not be able to pinpoint the exact portion of a long-

5

standing, widespread advertising campaign he or she relied on when purchasing a product.”

6

Yastrab v. Apple Inc., 173 F. Supp. 3d 972, 980 (N.D. Cal. 2016). That said, it is nevertheless not

7

enough to “nebulously reference a product’s advertising package and just declare the campaign

8

misleading.” Id. Here, Plaintiffs point broadly to Apple’s “purported privacy commitments” and

9

contend that Apple “claims to offer its mobile device users the option to control what data app

10

developers can collect by adjusting their device’s privacy settings.” CAC ¶ 44. But Plaintiffs do

11

not allege what is false or misleading about Apple’s marketing materials and why those materials

12

were misleading vis-à-vis Plaintiffs’ complained of data collection. See In re iPhone 4s Consumer

13

Litig., No. C 12-1127 CW, 2014 WL 589388, at *5 (N.D. Cal. Feb. 14, 2014), aff’d sub nom. In re

14

iPhone 4s Consumer Litig., 637 F. App’x 414 (9th Cir. 2016) (“Rule 9(b) therefore requires

15

Plaintiffs to aver specifically the statements they relied upon in making their purchases, what is

16

false or misleading about the statements, and why those statements turned out to be false”).

17

Although Plaintiffs sufficiently allege what Apple promises when the privacy setting is engaged

18

(CAC ¶¶ 44–49) and how they believe that promise was supposedly false (id. ¶¶ 50–52), they do

19

not similarly allege what is false or misleading about the advertisements and why those

20

advertisements turned out to be false. Moreover, only some of the Plaintiffs allege that they saw

21

or read any of the advertisements or marketing statements. For example, Bruce Puleo alleges he

22

“was exposed to advertisements from Apple touting the company’s commitment to privacy” (CAC

23

¶ 13), but others make no similar claim. See, e.g., id. ¶ 11; see In re Anthem, Inc. Data Breach

24

Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *37 (N.D. Cal. May 27, 2016) (dismissing

25

affirmative misrepresentation claim where none of the eleven plaintiffs alleged “they saw, read,

26

or—for that matter—even knew about [defendant’s] privacy policies prior to the data breach”).

27

Accordingly, Plaintiffs’ consumer law claims based on the advertisements are not plead

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
32

1

with particularity. Apple’s motion to dismiss the consumer protection claims based on a

2

misrepresentation is GRANTED with respect to the advertisements and the “Allow Apps to

3

Request to Track” setting but DENIED with respect to the “Share [Device] Analytics” setting.

4

Plaintiffs are permitted leave to amend.

5

United States District Court
Northern District of California

6

3.

Omission Theory

In addition to Apple’s misrepresentations in the two settings and advertising campaign,

7

Plaintiffs allege Apple’s omissions concerning Plaintiffs’ privacy violated the consumer protection

8

statutes. See, e.g., CAC ¶ 167. To the extent Plaintiffs’ omission theory relies on the “Allow

9

Apps to Request to Track” setting, it fails to state a plausible claim. As explained above, Apple

10

discloses the disputed data collection, and that setting unambiguously does not apply to Apple

11

Apps. Because Plaintiffs do not plausibly allege they withdrew their consent from the disclosed

12

data collection, Apple’s Privacy Policy and welcome screens do disclose the complained-of data

13

collection.

14

Apple also argues Plaintiffs failed to allege with particularity that, had Apple made specific

15

disclosures, Plaintiffs would have been aware of them and would not have purchased their devices.

16

Mot. 28 (citing Tabak v. Apple, Inc., No. 19-CV-02455-JST, 2020 WL 9066153, at *9 (N.D. Cal.

17

Jan. 30, 2020)). The Court agrees. Plaintiffs “need not prove that the omission was the only cause

18

or even the predominant cause, only that it was a substantial factor in [their] decision.” Daniel v.

19

Ford Motor Co., 806 F.3d 1217, 1225 (9th Cir. 2015). But Plaintiffs here make only conclusory

20

allegations they “would not have purchased their devices from [Apple] or would have paid less for

21

them.” See, e.g., CAC ¶ 171. As in Tabak, where plaintiffs alleged that they “would not have

22

purchased the devices at issue if they had known about the defect,” the allegations here lack

23

specific factual matter to raise the reasonable inference that, had Apple disclosed information

24

about the data collection at issue, Plaintiffs “would have been aware of it and behaved

25

differently.” Tabak, 2020 WL 9066153, at *9 (quoting Daniel, 806 F.3d at 1225). In response,

26

Plaintiffs argue that Apple “was obliged to disclose this collection” because Apple was in a

27

“superior position to know” about how it used the data. Opp. 27 (quoting Donohue v. Apple, Inc.,

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
33

1

871 F. Supp. 2d 913, 926 (N.D. Cal. 2012)). But even so, Plaintiffs must still include some detail

2

beyond conclusory statements that would suggest that disclosure of the data collection would have

3

played a role in Plaintiffs’ decision to purchase the devices at issue. Thus, Plaintiffs have not

4

sufficiently alleged a plausible fraudulent omission claim. Apple’s motion to dismiss the

5

consumer protection claims based on a fraudulent omission theory is GRANTED. Plaintiffs are

6

permitted leave to amend.

7

United States District Court
Northern District of California

8

4.

California UCL

Apple separately moves to dismiss Plaintiffs’ UCL claim because Plaintiffs “have not

9

alleged a misrepresentation or omission with particularity required by Rule 9(b)” and thus cannot

10

satisfy UCL’s “fraudulent” or “unlawful” prongs. Mot. 29. The Court found that Plaintiffs have

11

sufficiently plead at least a misrepresentation based on the “Share [Device] Analytics” setting.

12

Thus, Apple’s motion to dismiss on this basis fails. As for the “unfair” prong, Apple argues

13

Plaintiffs have not identified a specific constitutional, statutory, or regulatory provision to which

14

their claim is tethered. Mot. 30 (citing Drum v. San Fernando Valley Bar Ass’n, 182 Cal. App.

15

4th 247, 257 (2010)). And regarding the “unlawful” prong, Apple argues Plaintiffs’ passing

16

references to COPPA in the complaint fails to sufficiently plead how Apple violated that, or any

17

other, law. Plaintiffs do not challenge these apparent defects, and the Court will GRANT Apple’s

18

motion to dismiss Plaintiffs’ UCL claim based on the “unfair” and “unlawful” prongs with leave

19

to amend. Adam Askari D.D.S. Corp. v. U.S. Bancorp, No. 5:21-CV-09750-EJD, 2022 WL

20

2161603, at *3 (N.D. Cal. June 15, 2022) (“By failing to respond to those arguments, Plaintiff has

21

conceded them and acknowledged the Complaint should be dismissed on those grounds as well”).

22
23

5.

Damages

Apple also moves to dismiss the consumer protection claims because Plaintiffs do not

24

allege cognizable damages. Mot. 28–29. Each of Plaintiffs’ asserted consumer protection claims

25

require the loss of money or property. See Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732,

26

739–40 (7th Cir. 2014) (ICFDA requires “actual damages”); Small v. Lorillard Tobacco Co., 94

27

N.Y.2d 43, 56 (1999) (GBL requires “either pecuniary or ‘actual’ harm”); Kwikset Corp. v. Super.

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
34

1

Ct., 51 Cal. 4th 310, 323 (2011) (UCL requires “lost money or property”); Solo v. Bed Bath &

2

Beyond, Inc., 2007 WL 1237825, at *3 (D.N.J. Apr. 26, 2007) (NJCFA requires “ascertainable

3

loss of moneys or property”).

United States District Court
Northern District of California

4

Plaintiffs allege Apple “deprived Plaintiffs and Class Members of the economic value of

5

their user data” (CAC ¶ 84) and Plaintiffs “would not have purchased Apple’s devices and/or used

6

Apple’s Apps” (id. ¶ 208) or paid a “premium price to other equivalent phones” for Apple’s

7

devices (id. ¶ 209). Regarding the economic value of Plaintiffs’ data lost, courts in this district

8

appear split regarding whether privacy harms involving personal data can constitute an injury to

9

money or property sufficient to provide standing under the UCL. Compare In re Facebook Priv.

10

Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), aff’d 572 F. App’x 494 (9th Cir. 2014)

11

(“[P]ersonal information does not constitute property for purposes of a UCL claim”) and M.K. v.

12

Google LLC, No. 21-cv-08465-VKD, 2023 WL 2671381, at *5 (N.D. Cal. Mar. 27, 2023) (same)

13

with In re Meta Pixel Tax Filing Cases, No. 22-CV-07557-PCP, 2024 WL 1251350, at *24 (N.D.

14

Cal. Mar. 25, 2024) (privacy harms can constitute economic injury to confer UCL standing under

15

three theories: unfair benefit-of-the-bargain to businesses who violate user expectations about how

16

their data will be used, diminished value of personal information, and reduced right to exclude

17

others from accessing personal data) and Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D.

18

Cal. 2021) (“plaintiffs who suffered a loss of their personal information suffered economic injury

19

and had standing”).

20

Even assuming privacy harms involving personal data can constitute an injury to money or

21

property sufficient to provide standing under the UCL, the Court is not convinced Plaintiffs have

22

adequately alleged such harm here. “[J]ust because Plaintiffs’ data is valuable in the abstract, and

23

because [Apple] might have made money from it, does not mean that Plaintiffs have ‘lost money

24

or property’ as a result.” Hazel v. Prudential Fin., Inc., No. 22-CV-07465-CRB, 2023 WL

25

3933073, at *6 (N.D. Cal. June 9, 2023) (dismissing UCL claim for failing to allege lost money or

26

property); see also In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d at

27

804 (dismissing UCL claim and explaining that “Facebook may have gained money through its

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
35

1

sharing or use of the plaintiffs’ information, but that’s different from saying the plaintiffs lost

2

money”). Indeed, courts find allegations regarding loss of value of personal data sufficient where

3

the loss is somehow tethered to plaintiffs. See Brown v. Google LLC, No. 20-CV-03664-LHK,

4

2021 WL 6064009, at *15 (N.D. Cal. Dec. 22, 2021) (alleged loss of PII value sufficient under

5

UCL where “each named Plaintiff has alleged that he or she is aware of” platforms willing to pay

6

individuals for data); see also In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-

7

02752-LHK, 2017 WL 3727318, at *14 (N.D. Cal. Aug. 30, 2017) (same where plaintiffs alleged

8

their “PII is being sold by hackers on the dark web, and that Plaintiffs have lost the value of their

9

PII as a result”).

United States District Court
Northern District of California

10

Here, Plaintiffs allege that their personal user information is valuable in the abstract and

11

that they have suffered “loss of value in their personally identifiable information.” CAC ¶¶ 68–69,

12

158. Plaintiffs recognize that their internet browsing history “can be quantified, because

13

technology companies have been willing to pay users for the same or substantially the same user

14

data at issue here.” Id. ¶ 69 (citing studies showing certain contact information valued at $4.20 a

15

year). Although internet browsing history, or other personally identifiable information, can be

16

quantified or sold, Plaintiffs do not allege they intended to sell the data Apple collected or

17

otherwise allege that someone else would have bought the data. See Lau v. Gen Digital Inc., No.

18

22-CV-08981-JST, 2023 WL 10553772, at *7 (N.D. Cal. Sept. 13, 2023) (UCL claims dismissed

19

where plaintiffs do not allege that “they ever attempted or intended to participate” in the market

20

for the information allegedly collected and stored by defendants, “or otherwise to derive economic

21

value from” that information). Although the Court finds insufficient Plaintiffs’ allegations that

22

Apple “deprives Plaintiffs and Class Members of the economic value of their user data” under

23

UCL, Apple has not shown such allegations are insufficient under the other consumer protection

24

laws. See Mot. 29. The Court therefore declines to find the allegations insufficient under the

25

GBL, ICFDA, or NJCFA based on Plaintiffs’ loss of the value of their PII.

26

Plaintiffs also allege they would not have purchased Apple’s devices or used the Apps, or

27

would have paid less for Apple’s devices had they known about the data collection at issue. See,

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
36

United States District Court
Northern District of California

1

e.g., CAC ¶¶ 208, 209. These conclusory allegations, untethered in any way to Plaintiffs’

2

experiences, are insufficient to plead damages under the consumer protection laws. See Naimi v.

3

Starbucks Corp., 798 F. App’x 67, 70 (9th Cir. 2019) (“[u]nder New York law, a plaintiff’s

4

allegation that she would not have purchased a product but for a deceptive act, standing alone, is

5

not a cognizable injury because it conflates the deceptive act with the injury.”); Camasta v. Jos. A.

6

Bank Clothiers, Inc., 761 F.3d 732, 740 (7th Cir. 2014) (plaintiff failed to plead actual damage for

7

ICFDA claim where plaintiff alleged “without any factual support, that he paid more than the

8

value of the [product]”); Gerritsen v. FCA US LLC, No. CV 19-08268-AB (KSX), 2020 WL

9

3841304, at *1 (C.D. Cal. Mar. 3, 2020) (conclusory allegations of overpayment insufficient to

10

state injury under UCL); White v. Samsung Elecs. Am., Inc., No. CV 17-1775, 2019 WL 8886485,

11

at *3 (D.N.J. Aug. 21, 2019) (allegations that plaintiff “would not have purchased, or would have

12

paid substantially less for” product had she known of misrepresentation insufficient to plead

13

NJCFA claim).

14

***

15

Apple’s motion to dismiss Plaintiffs’ UCL claim is GRANTED for failing to allege

16

cognizable damages. Plaintiffs’ UCL claim based on (1) misrepresentations made via Apple’s

17

advertisements and the “Allow Apps to Request to Track” setting, (2) fraudulent omissions made

18

by Apple, and (3) a violation of the “unfair” or “unlawful” prongs also fails for reasons stated

19

above, and Apple’s motion to dismiss Plaintiff’s remaining consumer protection claims is

20

DENIED because Apple has not established the allegations insufficient under the GBL, ICFDA, or

21

NJCFA based on Plaintiffs’ loss of the value of their PII.

22

F.

23

Finally, Apple argues the Court lacks equitable jurisdiction to hear Plaintiffs’ UCL and

Equitable Relief

24

unjust enrichment claims because Plaintiffs fail to plead inadequate legal remedies. Mot. 30

25

(citing Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020)) for proposition that

26

Plaintiffs “must establish that [they] lack[] an adequate remedy at law before securing equitable

27

restitution for past harm under the UCL and CLRA”). Plaintiffs respond that, at this stage, they

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
37

United States District Court
Northern District of California

1

sufficiently plead that they lack an adequate remedy at law. Opp. 29 (citing CAC ¶ 287). The

2

Court agrees. Courts in this district typically permit the pursuit of alternative remedies at the

3

pleadings stage. Steiner v. Vi-Jon Inc., No. 23-CV-00473-AMO, 2024 WL 1181002, at *7 (N.D.

4

Cal. Mar. 18, 2024) (collecting cases). The complaint alleges that legal remedies “are inadequate

5

because they are not equally certain and prompt as equitable relief,” and “[d]amages are not

6

equally certain as restitution insofar as the Court may award restitution even if it determines that

7

insufficient evidence is provided to support an award of damages.” CAC ¶ 287. The Court finds

8

this sufficient at the pleading stage, and Apple’s motion is DENIED on this basis. But as

9

explained above (see supra Part IV(A)(2)), Plaintiffs’ unjust enrichment theory based on the

10

“Allow Apps to Request to Track” setting is DISMISSED because Apple disclosed the collection

11

at issue, and Plaintiffs’ interpretation of that setting is implausible. See Hicks v. PGA Tour, Inc.,

12

897 F.3d 1109, 1120 n.6 (9th Cir. 2018) (affirming dismissal of unjust enrichment claim based on

13

consent).

14

V.

15
16

CONCLUSION
For the foregoing reasons, the Court rules as follows:
•

To the extent Plaintiffs’ claims, other than Plaintiffs’ claim for violation of ICFDA,

17

are based exclusively on the “Allow Apps to Request to Track” setting, the Court

18

GRANTS Apple’s motion to dismiss.

19
20
21
22
23
24

•

All claims are DISMISSED WITH LEAVE TO AMEND, except for the following
claims, which are permitted to proceed for the reasons outlined above:
o Plaintiffs’ count one for breach of express contract based on the “Share
[Device] Analytics” setting;
o Plaintiffs’ count three for breach of implied covenant of good faith and fair
dealing based on the “Share [Device] Analytics” setting;

25

o Plaintiffs’ counts eight and nine for violation of New York’s GBL based on

26

purported misrepresentations made via Apple’s “Share [Device] Analytics”

27

setting;

28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
38

1

o Plaintiffs’ count ten for violation of NJCFA based on purported

2

misrepresentations made via Apple’s “Share [Device] Analytics” setting;

3

o Plaintiffs’ count eleven for violation of ICFDA based on misrepresentations

4

made via Apple’s “Share [Device] Analytics” and “Allow Apps to Request

5

to Track” setting; and

6
7

o Plaintiffs’ count twelve for unjust enrichment based on the “Share [Device]
Analytics” setting.

8
9

Any amended complaint must be filed within 30 days.

10

United States District Court
Northern District of California

11

IT IS SO ORDERED.

12
13

Dated: September 26, 2024

14
15
16

EDWARD J. DAVILA
United States District Judge

17
18
19
20
21
22
23
24
25
26
27
28

Case No.: 22-cv-07069-EJD
ORDER GRANTING IN PART; DENYING IN PART MOTION TO DISMISS
39