Smith v. Google, LLC

Filing 84

ORDER denying 50 Motion to Dismiss. Signed by Judge P. Casey Pitts on 6/3/2024. Joint Case Management Statement due by 6/13/2024. Initial Case Management Conference set for 6/27/2024 at 01:00 PM in San Jose, Courtroom 8, 4th Floor. (nmc, COURT USER) (Filed on 6/3/2024)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
MARY L. SMITH, et al.,

7

Plaintiffs,

8

ORDER DENYING MOTION TO
DISMISS

v.

9

GOOGLE, LLC,

10

Defendant.

11

United States District Court
Northern District of California

Case No. 23-cv-03527-PCP

12
In this consolidated putative class action against Google, LLC, plaintiffs bring several state

13
14

and federal law claims arising from Google’s alleged collection of their financial data through

15

tracking tools installed on several tax preparation websites. Google has moved to dismiss these

16

claims and seeks judicial notice of certain documents. For the reasons that follow, Google’s

17

requests for judicial notice are granted and its motion to dismiss is denied.

18

I.

Background

19

The following facts from the complaint are accepted as true for purposes of this motion.

20

Google operates a well-known search engine and many other internet services and

21

products. Google makes most of its money selling ads. Its advertising tools allow advertisers to

22

target a specific location, language, and audience. Google also offers tools that track how users

23

interact with websites. These tools can track groups of users who behave similarly or share

24

characteristics like age or gender. They can also track specific user actions on websites, like the

25

number of clicks, scrolls, searches, or downloads. These tools can link all of the data associated

26

with a single user. This data can measure how effective ads are and monitor how users behave.

27

One such tool is Google Analytics. Website owners can install an “invisible” snippet of

28

code which can measure actions users take on the site. When a user visits a website with Google

1

Analytics installed, the tracking code collects pseudonymous information about how the user

2

interacts with the webpage. By default, Google Analytics collects information about the user’s

3

browser, language, clicks, downloads, and form interactions, as well as the titles of webpages, and

4

matches the information it collects with a user’s location, gender, and general interests. Google

5

also offers a more powerful tracking tool called the Google Tag. This allows sophisticated web

6

publishers to customize what data is collected and how it is processed.

7
8

processes it into reports. According to the complaint, Google benefits from this collection because

9

it can use the data to power its algorithms and learn about user habits. The complaint alleges that

10

Google uses this data to assemble a “detailed dossier” for Google users and other website visitors.

11

United States District Court
Northern District of California

Data collected by these tools is sent in real time to Google, which stores the data and

H&R Block, TaxAct, and TaxSlayer are online tax filing services. The complaint alleges

12

that H&R Block “transmitted information about tax filers’ fillings to Google” (although it does not

13

allege which specific tracking tools or products H&R Block used). The complaint alleges that both

14

TaxAct and TaxSlayer disclosed “adjusted gross income and refund amounts” to Google.

15

Google purportedly prohibits Google Analytics customers from “passing any information

16

that could be used by Google to identify individuals.” According to the complaint, Google has

17

never contacted any of the tax preparation sites about their sharing potentially sensitive

18

information with Google, nor has Google suspended or terminated any of these sites’ accounts.

19

The named plaintiffs are residents of California, Florida, Georgia, Illinois, New York,

20

South Carolina, and Texas who used TaxAct, H&R Block, and TaxSlayer to prepare their taxes.

21

Each alleges that the site they used to file taxes had installed Google’s tracking tools. Plaintiffs

22

seek to represent a nationwide class of people who used online tax providers like H&R Block,

23

TaxAct, or TaxSlayer that used Google tracking tools, as well as California, Illinois, Florida, and

24

Texas subclasses.

25

Plaintiffs filed the present consolidated complaint after the Court consolidated two similar

26

cases. Plaintiffs assert eight claims under a variety of state and federal laws on behalf of the

27

putative nationwide class and state subclasses. Google has moved to dismiss the complaint under

28

Rule 12(b)(6) and requested judicial notice of several documents.
2

1

II.

2

A complaint that does not state a plausible claim upon which relief can be granted can be

3

dismissed under Federal Rule of Civil Procedure 12(b)(6). “A claim has facial plausibility when

4

the plaintiff pleads factual content that allows the court to draw the reasonable inference that the

5

defendant is liable.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Legal conclusions “must be

6

supported by factual allegations.” Id. at 679. The Court must “accept all factual allegations in the

7

complaint as true and construe the pleadings in the light most favorable to the nonmoving party.”

8

Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009).
There are two exceptions to the general rule that “courts may not consider material outside

9

United States District Court
Northern District of California

Legal Standards

10

the pleadings when assessing the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics,

11

Inc., 899 F.3d 988, 998 (9th Cir. 2018). First, Federal Rule of Evidence 201 permits judicial notice

12

of “a fact that is not subject to reasonable dispute” because the fact is “generally known” or “can

13

be accurately and readily determined from sources whose accuracy cannot reasonably be

14

questioned.” A court may take notice of “undisputed matters of public record,” but not of

15

“disputed facts stated in public records.” Lee v. City of L.A., 250 F.3d 668, 690 (9th Cir. 2001).

16

Second, the doctrine of incorporation by reference permits a court to treat an extrinsic document as

17

if it were part of the complaint if the pleading “refers extensively to the document” or if “the

18

document forms the basis” of a claim. Khoja, 899 F.3d at 1002. This can be proper “when

19

assessing the sufficiency of a claim requires that the document at issue be reviewed,” but is not

20

warranted when “the document merely creates a defense to the well-ple[aded] allegations.” Id.

21

III.

Requests for Judicial Notice

22

Google has requested judicial notice of several documents. These requests are granted.

23

First, Google seeks judicial notice of the “Google Analytics Terms of Service” posted on

24

its website. Google argues that this document is noticeable because it is posted on a public website

25

and, alternatively, because it is incorporated by reference into the complaint. Although the

26

complaint refers to “policies” that Google purportedly has in place, Compl. ¶ 42, this is not

27

enough for the document to be incorporated by reference. The complaint’s indirect reference to

28

“policies” is not the kind of extensive reference that would warrant incorporation, nor do the
3

1

claims arise from or depend on that agreement. Still, the Court takes notice of this document

2

because it is publicly available from a source whose accuracy cannot reasonably be questioned and

3

its contents can be accurately determined. But this notice is limited to the existence and contents

4

of this May 15, 2023 version of the document. The Court cannot conclude that any of the tax

5

preparation sites ever assented to the terms therein, or that plaintiffs had notice of the contents.
Second, Google seeks judicial notice of two other pages on its website that discuss Google

6
7

Analytics. This request is similarly granted, but notice is again limited to the existence of these

8

documents. The Court cannot conclude that these documents—a blog post addressing “Google

9

Analytics privacy” and a support article identifying “[b]est practices to avoid sending Personally

United States District Court
Northern District of California

10

Identifiable Information”—accurately characterize how Google’s tools operate.

11

Third, Google requests judicial notice of copies of the “TaxAct Privacy Policy,” the “H&R

12

Block Privacy Policy,” and the “TaxSlayer Privacy Policy” posted on the tax preparation services’

13

respective websites. These documents are not incorporated by reference, but the Court will

14

similarly take judicial notice of them because they are posted publicly. As before, though, the

15

Court cannot conclude that any of the plaintiffs ever saw or agreed to the terms therein, or that the

16

tax preparation companies operated in compliance with those policies.
Finally, Google requests judicial notice of purported additional versions of the Google

17
18

Analytics Terms of Service, the H&R Block Privacy Notice, the TaxAct Privacy Statement, and

19

the TaxSlayer Privacy Policy. These versions cover a broader range of effective dates than

20

Google’s original submission and are all taken from the Internet Archive’s “Wayback Machine”

21

archival service. This request is similarly granted but, again, judicial notice of the existence of

22

these documents in the Wayback Machine archive cannot support any conclusions regarding their

23

terms, plaintiffs’ consent to those terms, or Google’s compliance with those terms.

24

IV.

Motion To Dismiss

25

Google seeks dismissal of each of plaintiffs’ claims. The Court addresses them in turn.

26

A.

27

Section 631(a) of the California Penal Code makes punishable anyone who, “by means of

28

Count I: California Invasion of Privacy Act (Cal. Penal Code § 631)

any machine, instrument, or contrivance, or in any other manner,” does any of four things:
4

1

(1) “intentionally taps, or makes any unauthorized connection, whether physically, electrically,

2

acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or

3

instrument …”;
(2) “willfully and without the consent of all parties to the communication, or in any

4
5

unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any

6

message, report, or communication while the same is in transit or passing over any wire,

7

line, or cable, or is being sent from, or received at any place within this state”;
(3) “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any

8

way, any information so obtained”; or

United States District Court
Northern District of California

9
10

(4) “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or

11

permit, or cause to be done any of the acts or things mentioned above in this section.”

12

Section 631 is a criminal statute, but Section 637.2 provides a civil cause of action to anyone

13

“injured by a violation of this chapter … against the person who committed the violation.”
Google raises several challenges to the Section 631 claim. Because none have merit at this

14
15

stage, its motion to dismiss the claim under prongs two and three of Section 631 is denied.1

16

1.

Consent

Google first argues that plaintiffs consented to the tax sites’ use of Google Analytics.

17
18

Google argues that terms of service and privacy policies of which the Court has taken judicial

19

notice establish that plaintiffs consented to the use of Google Analytics. Although these

20

documents suggest that plaintiffs could have consented to Google’s alleged data collection,

21

plaintiffs specifically allege that they did not. The mere existence of various terms of service and

22

privacy policies cannot establish at this stage, where the Court must draw all reasonable inferences

23

in plaintiffs’ favor, that any of the plaintiffs did in fact consent. Google’s consent arguments do

24

not provide a basis to dismiss the Section 631 claim. See In re Meta Pixel Tax Filing Cases, ––– F.

25

Supp. 3d ––––, 2024 WL 1251350, at *5 (N.D. Cal. 2024) (rejecting similar consent arguments).

26
27
28

1

Plaintiffs confirmed at the hearing that they are not pursuing a claim under the first or fourth
prong. If they later seek to pursue a claim under these prongs, they may request leave to amend.
5

2.

1

Google next argues that the Section 631 claim should be dismissed because Google acted

2

United States District Court
Northern District of California

Vendor

3

as a “mere vendor” of a tool that allows websites to record their own interactions with their users.

4

Under Section 631, “it … matter[s] who is holding the tape recorder.” Javier v. Assurance

5

IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. 2023). If a party to a conversation uses a recording

6

device to capture it, Section 631 is not violated. See Rogers v. Ulrich, 52 Cal. App. 3d 894, 899

7

(1975) (explaining that Section 631 does not cover “participant recording”).2 But if a nonparty to a

8

conversation listens in directly or records the conversation themselves, they are generally liable

9

under Section 631 if the other elements of that claim are satisfied. See Ribas v. Clark, 38 Cal. 3d

10

355, 360–61 (1985) (explaining that Section 631 covers “simultaneous dissemination to an

11

unannounced second auditor, whether that auditor be a person or mechanical device”).
If Google Analytics is like a tape recorder, the question is who is “holding” it. Did Google

12
13

simply build a tape recorder and pass it off to the tax sites to use for their own purposes? Or did

14

Google not only create the tape recorder but also use it to make a recording? The former scenario

15

might not violate Section 631 under Rogers, but the latter would under Ribas. Some courts have

16

concluded that web tracking tools are like a tape recorder that is simply handed off to website

17

operators to collect data on their own users, even if the maker of the recording tool stores the data.

18

In Graham v. Noom, Inc., for example, one court in this district explained that “a software service

19

that captures its clients’ data, hosts it on [its own] servers, and allows the clients to analyze their

20

data” is simply “a tool—like the tape recorder in Rogers—that allows [a client] to record and

21

analyze its own data.” 533 F. Supp. 3d 823, 832–33 (N.D. Cal. 2021). But another court in this

22

district recently concluded that for an online tracking service to be more like a tape recorder

23

device than an eavesdropper using a tape recorder, the service must be entirely incapable of using

24

the data it collects and stores for any other purpose, “just as a tape recorder has no independent

25

capability to divulge the recording.” See Javier, 649 F. Supp. 3d at 900. Such a service might, for

26

example, encrypt the data it collects so that only the website developer, not the service provider,

27
28

2

Participant recording can violate other provisions of the California Invasion of Privacy Act, but
plaintiffs are not pursuing claims under any of those provisions.
6

1

United States District Court
Northern District of California

2

can access the unencrypted data.
Whether or not a third-party service incapable of using the data it collects might avoid

3

liability under Section 631, the complaint alleges that Google does read and use Google Analytics

4

data. It asserts that “Google Analytics … is not simply a ‘tool’ utilized by website owners for their

5

own purposes” but that Google “benefits (and profits from)” the use of Google Analytics and “can

6

use the data it gleans … to power its algorithms.” Compl. ¶ 29. It asserts that Google uses the data

7

from its tracking tools to compile a “detailed dossier, or digital fingerprint” for each of its users.

8

Id. Google Analytics is free, suggesting that Google derives some benefit when websites use the

9

tool. And when a website installs Google Analytics, “by default, Google Analytics matches that

10

information with users’ geolocation, gender, and general interests.” Compl. ¶ 34. The complaint is

11

not entirely clear about whether the user information that is “matched” is exclusively information

12

collected from a particular website or whether Google compares information collected through

13

web tracking tools to other information Google has already amassed, but it seems unlikely that tax

14

preparation websites sent Google information about their users’ “general interests.” Either way,

15

the complaint alleges that the collected data is “aggregated” and presented to Google Analytics

16

customers in an online “account dashboard.” Compl. ¶ 34. This suggests that Google processes

17

and analyzes the data it collects at least to some extent. Even if this processing is done primarily

18

for the benefit of Google Analytics users, Google is still the one “reading” and/or “using” the data

19

it collects for the purposes of Section 631. See also Valenzuela v. Nationwide Mut. Ins. Co., ––– F.

20

Supp. 3d ––––, 2023 WL 5266033, at *7 (C.D. Cal. 2023) (“Eavesdropping on a conversation at

21

the time it occurs is a violation of Section 631, even if done for the benefit of a party to the

22

conversation.”).

23

Plaintiffs’ allegations, which must be taken as true, suggest that Google is not simply a

24

vendor of a tool that websites can use to “record” their own users’ interactions on their websites,

25

but rather that Google read or used the data collected about these users. Although Google can

26

provide evidence to refute these allegations at a later stage, on this Rule 12(b)(6) motion Google’s

27

device-vendor arguments do not provide a basis to dismiss plaintiffs’ Section 631 claim.

28
7

1
2

Intent

Finally, Google argues that the Section 631 claim fails because the complaint does not

3

adequately plead intent. The complaint asserts that Google “intentionally tapped” plaintiffs’

4

communications and “willfully … read or attempted to read” their contents. Compl. ¶¶ 61–62. The

5

complaint acknowledges that Google has policies to prohibit customers from sending personally

6

identifiable information to Google, but it also contends that Google never enforced these policies

7

against any of the tax preparation sites and that it “would have known” of or “at best … turned a

8

blind eye to” the use of its tools to collect users’ tax information. Compl. ¶¶ 40, 42–43. The

9

complaint further alleges that the information transmitted to Google would have been “highly

10

United States District Court
Northern District of California

3.

valuable” as a “demographic marker[] for advertising purposes.” Compl. ¶ 40.

11

These allegations are sufficient to plead willfulness for the purposes of Rule 12(b)(6).

12

While Google argues that judicially noticeable policy documents suggest that Google did not

13

actually want to receive personally identifiable information and expressly prohibited developers

14

from transmitting such data, this presents a question of fact that the Court cannot resolve at this

15

stage. See Meta Pixel, 2024 WL 1251350, at *5 (“Whatever agreements may have been in place,

16

those agreements do not establish as a matter of law that Meta did not intend to receive the

17

information plaintiffs claim was transmitted.”).

18

Plaintiffs also note in their opposition brief that even under the higher Rule 9(b) standard,

19

intent can be averred generally. Google latches onto this passing reference to argue that plaintiffs

20

have “back[ed] themselves into the strictures of Rule 9(b)” and that plaintiffs’ “salacious

21

allegation” that Google prohibits websites from sending personal information but in fact intended

22

that websites do so means that their claims are subject to Rule 9(b). That is not how Rule 9(b)

23

works. Plaintiffs’ statutory claims here do not sound in fraud. Their claim requires intent, which

24

plaintiffs have specifically alleged. That Google also allegedly misrepresented its true intent is a

25

separate issue from whether Google actually did intend to receive the data. Because plaintiffs are

26

directly challenging Google’s alleged data collection rather than challenging any potentially

27

fraudulent or misleading representations about this collection, their claims do not sound in fraud

28

and are not subject to Rule 9(b).
8

4.

United States District Court
Northern District of California

1

Contents

2

The second and third prongs of Section 631 require reading, learning, or using the

3

“contents or meaning” of a communication. Google argues that plaintiffs’ allegations of the actual

4

data sent to Google are insufficient. The complaint states that “H&R Block, TaxAct, and

5

TaxSlayer have been quietly transmitting sensitive financial information to Google when

6

Americans file their taxes online.” Compl. ¶ 32. It alleges that “H&R Block reportedly transmitted

7

information about tax filers’ filings to Google” and that both TaxAct and Tax Slayer disclosed

8

“the dollar amount of adjusted gross income and refund amounts … to Google.” Compl. ¶¶ 38–39.

9

These allegations are not as detailed as they might be, nor are they as detailed as corresponding

10

allegations in the related case against Meta. And Google correctly points out that other statements

11

in the complaint are phrased as speculation rather than allegations. See, e.g., Compl. ¶ 37 (“The

12

type of data collected by these sites may include email addresses, data on users’ income, filing

13

status, refund amounts, buttons that were clicked, and year of return.”). Still, while these

14

allegations are thinner than those in the Meta Pixel complaint, they are enough to state a claim.

15

The complaint alleges that each of the three tax filing services transmitted sensitive financial

16

information about tax filings to Google. It alleges the kinds of information that the tax filing

17

services would have been able to transmit, and it alleges the mechanism for transmission.

18

Although it does not specify exactly what information was actually transmitted by H&R Block,

19

the allegations are sufficient at the pleading stage to state a claim that the contents or meaning of

20

plaintiffs’ confidential communications were read and/or used by Google.
*

21

*

*

22

For the foregoing reasons, Google’s motion to dismiss Count I is denied.

23

B.

24

Section 632 of the California Penal Code makes punishable anyone who “intentionally and

Count II: California Invasion of Privacy Act (Cal. Penal Code § 632)

25

without the consent of all parties to a confidential communication, uses an electronic amplifying

26

or recording device to eavesdrop upon or record the confidential communication, whether the

27

communication is carried on among the parties in the presence of one another or by means of a

28

telegraph, telephone, or other device, except a radio.”
9

1
2

United States District Court
Northern District of California

3

Google raises the same consent and intent arguments addressed above in moving to
dismiss the Section 632 claim, and they are rejected for the same reasons.
Google also argues that Section 632 does not apply because there is a “presumption” under

4

California law that online communications are not confidential. This view of California law

5

overreads the cases. A conversation is “confidential” under Section 632 if one of the parties has “a

6

reasonable expectation … that no one is listening in or overhearing the conversation.” Flanagan v.

7

Flanagan, 27 Cal. 4th 766, 772–73 (2002). Although California courts applying Section 632 to

8

online communications have concluded in certain cases that communications were not

9

confidential, “California courts have never recognized a legal ‘presumption’ that internet

10

communications are not confidential under Section 632.” See Brown v. Google LLC, ––– F. Supp.

11

3d. ––––, 2023 WL 5029899, at *18 (N.D. Cal. 2023). Further, the cases Google relies on

12

involved internet chats and emails, not sensitive financial information submitted to a tax

13

preparation website. See Campbell v. Facebook, Inc., 77 F. Supp. 3d 836, 848–49 (N.D. Cal.

14

2014) (collecting cases). The scattering of state and federal cases (none from the California

15

Supreme Court) considering various communications on a case-by-case basis do not establish that

16

California law presumes the non-confidentiality of all online communication. But see Revitch v.

17

New Moosejaw, LLC, No. 18-CV-06827-VC, 2019 WL 5485330, at *3 (N.D. Cal. Oct. 23, 2019)

18

(finding such a presumption).

19

In any case, the factual circumstances alleged here are clearly distinguishable from chats or

20

emails. Plaintiffs are not alleging that their communications with another person were intercepted.

21

The cases Google cites conclude that online chats and emails cannot be reasonably expected to be

22

confidential because they “can easily be shared by … the recipient(s).” See Campbell, 77 F. Supp.

23

3d at 849. But that reasoning is wholly inapplicable here. Plaintiffs instead allege that they

24

expected their tax information would remain confidential—an expectation they argue was

25

objectively reasonable because sharing tax return information without consent is a crime. At the

26

pleading stage, plaintiffs have plausibly alleged that Google intercepted communications that were

27

confidential under Section 632. Google’s motion to dismiss Count II is therefore denied.

28
10

1

C.

2

Section 635 of the California Penal Code makes punishable anyone who “manufactures,

3

assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to

4

another any device which is primarily or exclusively designed or intended for eavesdropping upon

5

the communication of another.” Plaintiffs assert that Google Analytics is a “device … primarily or

6

exclusively designed” for eavesdropping, and that Google has therefore violated Section 635.

7

They bring a civil claim for violation of this criminal provision pursuant to Section 637.2.

8

United States District Court
Northern District of California

Count III: California Invasion of Privacy Act (Cal. Penal Code § 635)

Section 637.2 provides a right of action to “[a]ny person who has been injured by a

9

violation of this chapter ... against the person who committed the violation.” Google briefly

10

contends that Section 637.2 does not allow claims under Section 635, but the Court recently

11

rejected this argument in its Meta Pixel decision, concluding that the “better interpretation” of

12

Section 637.2 is that “injuries caused by use of an eavesdropping device are traceable to the

13

manufacture, sale, and provision of that device, and that an injured party therefore has a private

14

right of action against the creator of the device.” 2024 WL 1251350, at *10.

15

Google next argues that Google Analytics is not designed or intended for eavesdropping.

16

Google contends that it is a vendor providing a tool to enable websites to record user interactions,

17

that such tools are commonplace, and that the vast majority of developers use Google Analytics in

18

a legitimate manner. But these are all factual responses to plaintiffs’ complaint. The complaint

19

asserts that Google Analytics is “primarily or exclusively” designed for eavesdropping. Compl.

20

¶ 77. It alleges that the Google Analytics tracking code is “invisible” to users and is a “default

21

feature.” Compl. ¶¶ 25–27. Even without the additional configuration available to “sophisticated”

22

users, the complaint alleges that the tracking code collects detailed information about user

23

behavior by default. See Compl. ¶¶ 25–27, 35. The complaint does not suggest that the optional

24

advanced features render data collection more surreptitious. Instead, the allegations simply suggest

25

that sophisticated users can exercise greater control over the type of data collected. As the Court

26

previously explained, “at the 12(b)(6) stage the question is not whether the Court can imagine any

27

purpose … other than eavesdropping but instead whether plaintiffs’ allegations are sufficient to

28

plausibly state a claim.” Meta Pixel, 2024 WL 1251350, at *11.
11

1
2

Google Analytics. As before, this is a factual determination that contradicts the pleadings, which

3

the Court must take as true. This argument is therefore similarly rejected.

4
5

United States District Court
Northern District of California

Finally, Google repeats its argument that plaintiffs consented to the tax sites’ use of

Because plaintiffs have alleged facts that state a Section 635 violation, Google’s motion to
dismiss Count III is denied.

6

D.

7

Google argues that plaintiffs’ federal Wiretap Act claim should be dismissed because

Count IV: Wiretap Act (18 U.S.C. § 2510, et seq.)

8

plaintiffs have not adequately alleged intent, because Google is merely acting as a vendor and is

9

not “intercepting” communications, and because the websites consented to data collection. The

10

intent and vendor liability arguments are the same as Google’s arguments against the California

11

Invasion of Privacy Act claims and are rejected for the same reasons. With respect to consent,

12

Google argues that because the tax sites “chose to use Google Analytics, they obviously consented

13

to it.” But this argument draws a crucial inference in Google’s favor—that in addition to installing

14

Google Analytics, website operators understood how the software works and what data would be

15

sent to Google and fully consented to that transmission. The complaint alleges that Google

16

purportedly prohibited sending personal information via Google Analytics but nevertheless

17

allowed such information to be transmitted (to its benefit). Taking this as true, the Court cannot

18

presume that every website owner who installed Google Analytics understood exactly what data

19

would be sent to Google and how Google might use it. Whether developers consented to data

20

collection by using Google Analytics is a fact dispute that cannot be resolved at this stage.

21

Accordingly, Google’s motion to dismiss Count IV is denied.

22

E.

23

18 U.S.C. § 2512(1)(b) is similar to Section 635. It makes punishable any person who

Count V: Wiretap Act (18 U.S.C. § 2512)

24

“intentionally … manufactures, assembles, possesses, or sells any electronic, mechanical, or other

25

device, knowing or having reason to know that the design of such device renders it primarily

26

useful for the purpose of the surreptitious interception of wire, oral, or electronic communications,

27

and that such device or any component thereof has been or will be sent through the mail or

28

transported in interstate or foreign commerce.” 18 U.S.C. § 2512(1)(b). Section 2520, in turn,
12

1

provides that “any person whose wire, oral, or electronic communication is intercepted, disclosed,

2

or intentionally used in violation of this chapter may in a civil action recover from the person or

3

entity, other than the United States, which engaged in that violation.”
Google raises the same arguments against the federal Section 2512 claim as the California

4
5

Section 635 claim. The consent and device-design arguments are rejected for the same reasons.

6

And as the Court has previously concluded, “Section 2520 at the very least provides a private

7

cause of action to enforce Section 2512(1)(b) against a defendant who also played an active role in

8

the unlawful interception, disclosure, or use of the plaintiff's communication.” 2024 WL 1251350,

9

at *12. Here, as in Meta Pixel, plaintiffs allege that Google not only created Google Analytics but

United States District Court
Northern District of California

10

also played an active role in its use to collect data from tax site users. See, e.g., Compl. ¶ 28.

11

Google also argues that plaintiffs have failed to plausibly allege that Google knew that

12

Google Analytics could be primarily used for a criminal purpose, as required under the federal

13

statute. But plaintiffs allege that Google furnished Google Analytics “with knowledge that it

14

would primarily be used to illegally intercept electronic communications.” Compl. ¶ 182. Google

15

argues that this allegation cannot be plausible in the face of Google’s policies purporting to require

16

that developers disclose their use of Google Analytics and obtain user consent. But this too

17

requires making factual determinations and drawing inferences in Google’s favor that go beyond

18

the pleadings and materials subject to judicial notice. Indeed, as the Court concluded in Meta

19

Pixel, “although disclosures about how [a tool] collects data might support a conclusion that

20

collection was not surreptitious, the fact that additional disclosures not inherent to the device’s

21

design are necessary to warn tracked individuals about how it works might also indicate that the

22

[tool’s] design does render it useful for surreptitious collection.” 2024 WL 1251350, at *11. Here,

23

too, the plaintiffs’ allegations regarding knowledge and intent are sufficient at the Rule 12(b)(6)

24

stage.

25

Accordingly, Google’s motion to dismiss Count V is denied.

26

F.

27

The Florida Security of Communications Act provides a civil cause of action for criminal

28

Count VI: Florida Security of Communications Act (Fla. Stat. § 934.10)

wiretap violations. Fla. Stat. §§ 934.03, 934.10. Google repeats its consent and vendor arguments,
13

United States District Court
Northern District of California

1

which are rejected for the reasons discussed above. The motion to dismiss Count VI is denied.

2

G.

3

The Illinois eavesdropping statute provides that “[a] person commits eavesdropping when

Count VII: Illinois Eavesdropping Statute (720 Ill. Comp. Stat. 5/14)

4

he or she knowingly and intentionally … [i]ntercepts, records, or transcribes, in a surreptitious

5

manner, any private electronic communication to which he or she is not a party unless he or she

6

does so with the consent of all parties to the private electronic communication.” 720 Ill. Comp.

7

Stat. 5/14-2(a). Google’s consent, intent, and vendor-liability arguments are again rejected. Google

8

also argues that the complaint fails to allege intentional interception “in a surreptitious manner” as

9

required. But the complaint alleges that the Google Analytics tracking code is “invisible” and was

10

used to “quietly transmit[]” plaintiffs’ sensitive financial information to Google. Compl. ¶¶ 25, 32.

11

This is enough to state a claim. Whether Google or the tax sites disclosed their use of Google

12

Analytics to plaintiffs in a manner that rendered it not surreptitious is a factual issue that cannot be

13

resolved on the pleadings. The motion to dismiss Count VII is therefore denied.

14

H.

15

Google raises the same arguments against the Texas claims as the federal wiretap claims,

16

and they are rejected for the same reasons. The motion to dismiss Count VII is therefore denied.

17

V.

18
19
20
21

Count VIII: Texas Wiretap Statute (Tex. Penal Code § 16.02)

Conclusion
For the reasons set forth above, Google’s requests for judicial notice are granted and its

motion to dismiss is denied.
Pursuant to the parties’ stipulation, the initial case management conference is reset for June
27, 2024. The parties shall submit a joint case management statement by June 13, 2024.

22
23
24

IT IS SO ORDERED.
Dated: June 3, 2024

25
26
P. Casey Pitts
United States District Judge

27
28
14