Smith v. Google, LLC
Filing
84
ORDER denying 50 Motion to Dismiss. Signed by Judge P. Casey Pitts on 6/3/2024. Joint Case Management Statement due by 6/13/2024. Initial Case Management Conference set for 6/27/2024 at 01:00 PM in San Jose, Courtroom 8, 4th Floor. (nmc, COURT USER) (Filed on 6/3/2024)
1
2
3
4
UNITED STATES DISTRICT COURT
5
NORTHERN DISTRICT OF CALIFORNIA
6
MARY L. SMITH, et al.,
7
Plaintiffs,
8
ORDER DENYING MOTION TO
DISMISS
v.
9
GOOGLE, LLC,
10
Defendant.
11
United States District Court
Northern District of California
Case No. 23-cv-03527-PCP
12
In this consolidated putative class action against Google, LLC, plaintiffs bring several state
13
14
and federal law claims arising from Google’s alleged collection of their financial data through
15
tracking tools installed on several tax preparation websites. Google has moved to dismiss these
16
claims and seeks judicial notice of certain documents. For the reasons that follow, Google’s
17
requests for judicial notice are granted and its motion to dismiss is denied.
18
I.
Background
19
The following facts from the complaint are accepted as true for purposes of this motion.
20
Google operates a well-known search engine and many other internet services and
21
products. Google makes most of its money selling ads. Its advertising tools allow advertisers to
22
target a specific location, language, and audience. Google also offers tools that track how users
23
interact with websites. These tools can track groups of users who behave similarly or share
24
characteristics like age or gender. They can also track specific user actions on websites, like the
25
number of clicks, scrolls, searches, or downloads. These tools can link all of the data associated
26
with a single user. This data can measure how effective ads are and monitor how users behave.
27
One such tool is Google Analytics. Website owners can install an “invisible” snippet of
28
code which can measure actions users take on the site. When a user visits a website with Google
1
Analytics installed, the tracking code collects pseudonymous information about how the user
2
interacts with the webpage. By default, Google Analytics collects information about the user’s
3
browser, language, clicks, downloads, and form interactions, as well as the titles of webpages, and
4
matches the information it collects with a user’s location, gender, and general interests. Google
5
also offers a more powerful tracking tool called the Google Tag. This allows sophisticated web
6
publishers to customize what data is collected and how it is processed.
7
8
processes it into reports. According to the complaint, Google benefits from this collection because
9
it can use the data to power its algorithms and learn about user habits. The complaint alleges that
10
Google uses this data to assemble a “detailed dossier” for Google users and other website visitors.
11
United States District Court
Northern District of California
Data collected by these tools is sent in real time to Google, which stores the data and
H&R Block, TaxAct, and TaxSlayer are online tax filing services. The complaint alleges
12
that H&R Block “transmitted information about tax filers’ fillings to Google” (although it does not
13
allege which specific tracking tools or products H&R Block used). The complaint alleges that both
14
TaxAct and TaxSlayer disclosed “adjusted gross income and refund amounts” to Google.
15
Google purportedly prohibits Google Analytics customers from “passing any information
16
that could be used by Google to identify individuals.” According to the complaint, Google has
17
never contacted any of the tax preparation sites about their sharing potentially sensitive
18
information with Google, nor has Google suspended or terminated any of these sites’ accounts.
19
The named plaintiffs are residents of California, Florida, Georgia, Illinois, New York,
20
South Carolina, and Texas who used TaxAct, H&R Block, and TaxSlayer to prepare their taxes.
21
Each alleges that the site they used to file taxes had installed Google’s tracking tools. Plaintiffs
22
seek to represent a nationwide class of people who used online tax providers like H&R Block,
23
TaxAct, or TaxSlayer that used Google tracking tools, as well as California, Illinois, Florida, and
24
Texas subclasses.
25
Plaintiffs filed the present consolidated complaint after the Court consolidated two similar
26
cases. Plaintiffs assert eight claims under a variety of state and federal laws on behalf of the
27
putative nationwide class and state subclasses. Google has moved to dismiss the complaint under
28
Rule 12(b)(6) and requested judicial notice of several documents.
2
1
II.
2
A complaint that does not state a plausible claim upon which relief can be granted can be
3
dismissed under Federal Rule of Civil Procedure 12(b)(6). “A claim has facial plausibility when
4
the plaintiff pleads factual content that allows the court to draw the reasonable inference that the
5
defendant is liable.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Legal conclusions “must be
6
supported by factual allegations.” Id. at 679. The Court must “accept all factual allegations in the
7
complaint as true and construe the pleadings in the light most favorable to the nonmoving party.”
8
Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009).
There are two exceptions to the general rule that “courts may not consider material outside
9
United States District Court
Northern District of California
Legal Standards
10
the pleadings when assessing the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics,
11
Inc., 899 F.3d 988, 998 (9th Cir. 2018). First, Federal Rule of Evidence 201 permits judicial notice
12
of “a fact that is not subject to reasonable dispute” because the fact is “generally known” or “can
13
be accurately and readily determined from sources whose accuracy cannot reasonably be
14
questioned.” A court may take notice of “undisputed matters of public record,” but not of
15
“disputed facts stated in public records.” Lee v. City of L.A., 250 F.3d 668, 690 (9th Cir. 2001).
16
Second, the doctrine of incorporation by reference permits a court to treat an extrinsic document as
17
if it were part of the complaint if the pleading “refers extensively to the document” or if “the
18
document forms the basis” of a claim. Khoja, 899 F.3d at 1002. This can be proper “when
19
assessing the sufficiency of a claim requires that the document at issue be reviewed,” but is not
20
warranted when “the document merely creates a defense to the well-ple[aded] allegations.” Id.
21
III.
Requests for Judicial Notice
22
Google has requested judicial notice of several documents. These requests are granted.
23
First, Google seeks judicial notice of the “Google Analytics Terms of Service” posted on
24
its website. Google argues that this document is noticeable because it is posted on a public website
25
and, alternatively, because it is incorporated by reference into the complaint. Although the
26
complaint refers to “policies” that Google purportedly has in place, Compl. ¶ 42, this is not
27
enough for the document to be incorporated by reference. The complaint’s indirect reference to
28
“policies” is not the kind of extensive reference that would warrant incorporation, nor do the
3
1
claims arise from or depend on that agreement. Still, the Court takes notice of this document
2
because it is publicly available from a source whose accuracy cannot reasonably be questioned and
3
its contents can be accurately determined. But this notice is limited to the existence and contents
4
of this May 15, 2023 version of the document. The Court cannot conclude that any of the tax
5
preparation sites ever assented to the terms therein, or that plaintiffs had notice of the contents.
Second, Google seeks judicial notice of two other pages on its website that discuss Google
6
7
Analytics. This request is similarly granted, but notice is again limited to the existence of these
8
documents. The Court cannot conclude that these documents—a blog post addressing “Google
9
Analytics privacy” and a support article identifying “[b]est practices to avoid sending Personally
United States District Court
Northern District of California
10
Identifiable Information”—accurately characterize how Google’s tools operate.
11
Third, Google requests judicial notice of copies of the “TaxAct Privacy Policy,” the “H&R
12
Block Privacy Policy,” and the “TaxSlayer Privacy Policy” posted on the tax preparation services’
13
respective websites. These documents are not incorporated by reference, but the Court will
14
similarly take judicial notice of them because they are posted publicly. As before, though, the
15
Court cannot conclude that any of the plaintiffs ever saw or agreed to the terms therein, or that the
16
tax preparation companies operated in compliance with those policies.
Finally, Google requests judicial notice of purported additional versions of the Google
17
18
Analytics Terms of Service, the H&R Block Privacy Notice, the TaxAct Privacy Statement, and
19
the TaxSlayer Privacy Policy. These versions cover a broader range of effective dates than
20
Google’s original submission and are all taken from the Internet Archive’s “Wayback Machine”
21
archival service. This request is similarly granted but, again, judicial notice of the existence of
22
these documents in the Wayback Machine archive cannot support any conclusions regarding their
23
terms, plaintiffs’ consent to those terms, or Google’s compliance with those terms.
24
IV.
Motion To Dismiss
25
Google seeks dismissal of each of plaintiffs’ claims. The Court addresses them in turn.
26
A.
27
Section 631(a) of the California Penal Code makes punishable anyone who, “by means of
28
Count I: California Invasion of Privacy Act (Cal. Penal Code § 631)
any machine, instrument, or contrivance, or in any other manner,” does any of four things:
4
1
(1) “intentionally taps, or makes any unauthorized connection, whether physically, electrically,
2
acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or
3
instrument …”;
(2) “willfully and without the consent of all parties to the communication, or in any
4
5
unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any
6
message, report, or communication while the same is in transit or passing over any wire,
7
line, or cable, or is being sent from, or received at any place within this state”;
(3) “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any
8
way, any information so obtained”; or
United States District Court
Northern District of California
9
10
(4) “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or
11
permit, or cause to be done any of the acts or things mentioned above in this section.”
12
Section 631 is a criminal statute, but Section 637.2 provides a civil cause of action to anyone
13
“injured by a violation of this chapter … against the person who committed the violation.”
Google raises several challenges to the Section 631 claim. Because none have merit at this
14
15
stage, its motion to dismiss the claim under prongs two and three of Section 631 is denied.1
16
1.
Consent
Google first argues that plaintiffs consented to the tax sites’ use of Google Analytics.
17
18
Google argues that terms of service and privacy policies of which the Court has taken judicial
19
notice establish that plaintiffs consented to the use of Google Analytics. Although these
20
documents suggest that plaintiffs could have consented to Google’s alleged data collection,
21
plaintiffs specifically allege that they did not. The mere existence of various terms of service and
22
privacy policies cannot establish at this stage, where the Court must draw all reasonable inferences
23
in plaintiffs’ favor, that any of the plaintiffs did in fact consent. Google’s consent arguments do
24
not provide a basis to dismiss the Section 631 claim. See In re Meta Pixel Tax Filing Cases, ––– F.
25
Supp. 3d ––––, 2024 WL 1251350, at *5 (N.D. Cal. 2024) (rejecting similar consent arguments).
26
27
28
1
Plaintiffs confirmed at the hearing that they are not pursuing a claim under the first or fourth
prong. If they later seek to pursue a claim under these prongs, they may request leave to amend.
5
2.
1
Google next argues that the Section 631 claim should be dismissed because Google acted
2
United States District Court
Northern District of California
Vendor
3
as a “mere vendor” of a tool that allows websites to record their own interactions with their users.
4
Under Section 631, “it … matter[s] who is holding the tape recorder.” Javier v. Assurance
5
IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. 2023). If a party to a conversation uses a recording
6
device to capture it, Section 631 is not violated. See Rogers v. Ulrich, 52 Cal. App. 3d 894, 899
7
(1975) (explaining that Section 631 does not cover “participant recording”).2 But if a nonparty to a
8
conversation listens in directly or records the conversation themselves, they are generally liable
9
under Section 631 if the other elements of that claim are satisfied. See Ribas v. Clark, 38 Cal. 3d
10
355, 360–61 (1985) (explaining that Section 631 covers “simultaneous dissemination to an
11
unannounced second auditor, whether that auditor be a person or mechanical device”).
If Google Analytics is like a tape recorder, the question is who is “holding” it. Did Google
12
13
simply build a tape recorder and pass it off to the tax sites to use for their own purposes? Or did
14
Google not only create the tape recorder but also use it to make a recording? The former scenario
15
might not violate Section 631 under Rogers, but the latter would under Ribas. Some courts have
16
concluded that web tracking tools are like a tape recorder that is simply handed off to website
17
operators to collect data on their own users, even if the maker of the recording tool stores the data.
18
In Graham v. Noom, Inc., for example, one court in this district explained that “a software service
19
that captures its clients’ data, hosts it on [its own] servers, and allows the clients to analyze their
20
data” is simply “a tool—like the tape recorder in Rogers—that allows [a client] to record and
21
analyze its own data.” 533 F. Supp. 3d 823, 832–33 (N.D. Cal. 2021). But another court in this
22
district recently concluded that for an online tracking service to be more like a tape recorder
23
device than an eavesdropper using a tape recorder, the service must be entirely incapable of using
24
the data it collects and stores for any other purpose, “just as a tape recorder has no independent
25
capability to divulge the recording.” See Javier, 649 F. Supp. 3d at 900. Such a service might, for
26
example, encrypt the data it collects so that only the website developer, not the service provider,
27
28
2
Participant recording can violate other provisions of the California Invasion of Privacy Act, but
plaintiffs are not pursuing claims under any of those provisions.
6
1
United States District Court
Northern District of California
2
can access the unencrypted data.
Whether or not a third-party service incapable of using the data it collects might avoid
3
liability under Section 631, the complaint alleges that Google does read and use Google Analytics
4
data. It asserts that “Google Analytics … is not simply a ‘tool’ utilized by website owners for their
5
own purposes” but that Google “benefits (and profits from)” the use of Google Analytics and “can
6
use the data it gleans … to power its algorithms.” Compl. ¶ 29. It asserts that Google uses the data
7
from its tracking tools to compile a “detailed dossier, or digital fingerprint” for each of its users.
8
Id. Google Analytics is free, suggesting that Google derives some benefit when websites use the
9
tool. And when a website installs Google Analytics, “by default, Google Analytics matches that
10
information with users’ geolocation, gender, and general interests.” Compl. ¶ 34. The complaint is
11
not entirely clear about whether the user information that is “matched” is exclusively information
12
collected from a particular website or whether Google compares information collected through
13
web tracking tools to other information Google has already amassed, but it seems unlikely that tax
14
preparation websites sent Google information about their users’ “general interests.” Either way,
15
the complaint alleges that the collected data is “aggregated” and presented to Google Analytics
16
customers in an online “account dashboard.” Compl. ¶ 34. This suggests that Google processes
17
and analyzes the data it collects at least to some extent. Even if this processing is done primarily
18
for the benefit of Google Analytics users, Google is still the one “reading” and/or “using” the data
19
it collects for the purposes of Section 631. See also Valenzuela v. Nationwide Mut. Ins. Co., ––– F.
20
Supp. 3d ––––, 2023 WL 5266033, at *7 (C.D. Cal. 2023) (“Eavesdropping on a conversation at
21
the time it occurs is a violation of Section 631, even if done for the benefit of a party to the
22
conversation.”).
23
Plaintiffs’ allegations, which must be taken as true, suggest that Google is not simply a
24
vendor of a tool that websites can use to “record” their own users’ interactions on their websites,
25
but rather that Google read or used the data collected about these users. Although Google can
26
provide evidence to refute these allegations at a later stage, on this Rule 12(b)(6) motion Google’s
27
device-vendor arguments do not provide a basis to dismiss plaintiffs’ Section 631 claim.
28
7
1
2
Intent
Finally, Google argues that the Section 631 claim fails because the complaint does not
3
adequately plead intent. The complaint asserts that Google “intentionally tapped” plaintiffs’
4
communications and “willfully … read or attempted to read” their contents. Compl. ¶¶ 61–62. The
5
complaint acknowledges that Google has policies to prohibit customers from sending personally
6
identifiable information to Google, but it also contends that Google never enforced these policies
7
against any of the tax preparation sites and that it “would have known” of or “at best … turned a
8
blind eye to” the use of its tools to collect users’ tax information. Compl. ¶¶ 40, 42–43. The
9
complaint further alleges that the information transmitted to Google would have been “highly
10
United States District Court
Northern District of California
3.
valuable” as a “demographic marker[] for advertising purposes.” Compl. ¶ 40.
11
These allegations are sufficient to plead willfulness for the purposes of Rule 12(b)(6).
12
While Google argues that judicially noticeable policy documents suggest that Google did not
13
actually want to receive personally identifiable information and expressly prohibited developers
14
from transmitting such data, this presents a question of fact that the Court cannot resolve at this
15
stage. See Meta Pixel, 2024 WL 1251350, at *5 (“Whatever agreements may have been in place,
16
those agreements do not establish as a matter of law that Meta did not intend to receive the
17
information plaintiffs claim was transmitted.”).
18
Plaintiffs also note in their opposition brief that even under the higher Rule 9(b) standard,
19
intent can be averred generally. Google latches onto this passing reference to argue that plaintiffs
20
have “back[ed] themselves into the strictures of Rule 9(b)” and that plaintiffs’ “salacious
21
allegation” that Google prohibits websites from sending personal information but in fact intended
22
that websites do so means that their claims are subject to Rule 9(b). That is not how Rule 9(b)
23
works. Plaintiffs’ statutory claims here do not sound in fraud. Their claim requires intent, which
24
plaintiffs have specifically alleged. That Google also allegedly misrepresented its true intent is a
25
separate issue from whether Google actually did intend to receive the data. Because plaintiffs are
26
directly challenging Google’s alleged data collection rather than challenging any potentially
27
fraudulent or misleading representations about this collection, their claims do not sound in fraud
28
and are not subject to Rule 9(b).
8
4.
United States District Court
Northern District of California
1
Contents
2
The second and third prongs of Section 631 require reading, learning, or using the
3
“contents or meaning” of a communication. Google argues that plaintiffs’ allegations of the actual
4
data sent to Google are insufficient. The complaint states that “H&R Block, TaxAct, and
5
TaxSlayer have been quietly transmitting sensitive financial information to Google when
6
Americans file their taxes online.” Compl. ¶ 32. It alleges that “H&R Block reportedly transmitted
7
information about tax filers’ filings to Google” and that both TaxAct and Tax Slayer disclosed
8
“the dollar amount of adjusted gross income and refund amounts … to Google.” Compl. ¶¶ 38–39.
9
These allegations are not as detailed as they might be, nor are they as detailed as corresponding
10
allegations in the related case against Meta. And Google correctly points out that other statements
11
in the complaint are phrased as speculation rather than allegations. See, e.g., Compl. ¶ 37 (“The
12
type of data collected by these sites may include email addresses, data on users’ income, filing
13
status, refund amounts, buttons that were clicked, and year of return.”). Still, while these
14
allegations are thinner than those in the Meta Pixel complaint, they are enough to state a claim.
15
The complaint alleges that each of the three tax filing services transmitted sensitive financial
16
information about tax filings to Google. It alleges the kinds of information that the tax filing
17
services would have been able to transmit, and it alleges the mechanism for transmission.
18
Although it does not specify exactly what information was actually transmitted by H&R Block,
19
the allegations are sufficient at the pleading stage to state a claim that the contents or meaning of
20
plaintiffs’ confidential communications were read and/or used by Google.
*
21
*
*
22
For the foregoing reasons, Google’s motion to dismiss Count I is denied.
23
B.
24
Section 632 of the California Penal Code makes punishable anyone who “intentionally and
Count II: California Invasion of Privacy Act (Cal. Penal Code § 632)
25
without the consent of all parties to a confidential communication, uses an electronic amplifying
26
or recording device to eavesdrop upon or record the confidential communication, whether the
27
communication is carried on among the parties in the presence of one another or by means of a
28
telegraph, telephone, or other device, except a radio.”
9
1
2
United States District Court
Northern District of California
3
Google raises the same consent and intent arguments addressed above in moving to
dismiss the Section 632 claim, and they are rejected for the same reasons.
Google also argues that Section 632 does not apply because there is a “presumption” under
4
California law that online communications are not confidential. This view of California law
5
overreads the cases. A conversation is “confidential” under Section 632 if one of the parties has “a
6
reasonable expectation … that no one is listening in or overhearing the conversation.” Flanagan v.
7
Flanagan, 27 Cal. 4th 766, 772–73 (2002). Although California courts applying Section 632 to
8
online communications have concluded in certain cases that communications were not
9
confidential, “California courts have never recognized a legal ‘presumption’ that internet
10
communications are not confidential under Section 632.” See Brown v. Google LLC, ––– F. Supp.
11
3d. ––––, 2023 WL 5029899, at *18 (N.D. Cal. 2023). Further, the cases Google relies on
12
involved internet chats and emails, not sensitive financial information submitted to a tax
13
preparation website. See Campbell v. Facebook, Inc., 77 F. Supp. 3d 836, 848–49 (N.D. Cal.
14
2014) (collecting cases). The scattering of state and federal cases (none from the California
15
Supreme Court) considering various communications on a case-by-case basis do not establish that
16
California law presumes the non-confidentiality of all online communication. But see Revitch v.
17
New Moosejaw, LLC, No. 18-CV-06827-VC, 2019 WL 5485330, at *3 (N.D. Cal. Oct. 23, 2019)
18
(finding such a presumption).
19
In any case, the factual circumstances alleged here are clearly distinguishable from chats or
20
emails. Plaintiffs are not alleging that their communications with another person were intercepted.
21
The cases Google cites conclude that online chats and emails cannot be reasonably expected to be
22
confidential because they “can easily be shared by … the recipient(s).” See Campbell, 77 F. Supp.
23
3d at 849. But that reasoning is wholly inapplicable here. Plaintiffs instead allege that they
24
expected their tax information would remain confidential—an expectation they argue was
25
objectively reasonable because sharing tax return information without consent is a crime. At the
26
pleading stage, plaintiffs have plausibly alleged that Google intercepted communications that were
27
confidential under Section 632. Google’s motion to dismiss Count II is therefore denied.
28
10
1
C.
2
Section 635 of the California Penal Code makes punishable anyone who “manufactures,
3
assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to
4
another any device which is primarily or exclusively designed or intended for eavesdropping upon
5
the communication of another.” Plaintiffs assert that Google Analytics is a “device … primarily or
6
exclusively designed” for eavesdropping, and that Google has therefore violated Section 635.
7
They bring a civil claim for violation of this criminal provision pursuant to Section 637.2.
8
United States District Court
Northern District of California
Count III: California Invasion of Privacy Act (Cal. Penal Code § 635)
Section 637.2 provides a right of action to “[a]ny person who has been injured by a
9
violation of this chapter ... against the person who committed the violation.” Google briefly
10
contends that Section 637.2 does not allow claims under Section 635, but the Court recently
11
rejected this argument in its Meta Pixel decision, concluding that the “better interpretation” of
12
Section 637.2 is that “injuries caused by use of an eavesdropping device are traceable to the
13
manufacture, sale, and provision of that device, and that an injured party therefore has a private
14
right of action against the creator of the device.” 2024 WL 1251350, at *10.
15
Google next argues that Google Analytics is not designed or intended for eavesdropping.
16
Google contends that it is a vendor providing a tool to enable websites to record user interactions,
17
that such tools are commonplace, and that the vast majority of developers use Google Analytics in
18
a legitimate manner. But these are all factual responses to plaintiffs’ complaint. The complaint
19
asserts that Google Analytics is “primarily or exclusively” designed for eavesdropping. Compl.
20
¶ 77. It alleges that the Google Analytics tracking code is “invisible” to users and is a “default
21
feature.” Compl. ¶¶ 25–27. Even without the additional configuration available to “sophisticated”
22
users, the complaint alleges that the tracking code collects detailed information about user
23
behavior by default. See Compl. ¶¶ 25–27, 35. The complaint does not suggest that the optional
24
advanced features render data collection more surreptitious. Instead, the allegations simply suggest
25
that sophisticated users can exercise greater control over the type of data collected. As the Court
26
previously explained, “at the 12(b)(6) stage the question is not whether the Court can imagine any
27
purpose … other than eavesdropping but instead whether plaintiffs’ allegations are sufficient to
28
plausibly state a claim.” Meta Pixel, 2024 WL 1251350, at *11.
11
1
2
Google Analytics. As before, this is a factual determination that contradicts the pleadings, which
3
the Court must take as true. This argument is therefore similarly rejected.
4
5
United States District Court
Northern District of California
Finally, Google repeats its argument that plaintiffs consented to the tax sites’ use of
Because plaintiffs have alleged facts that state a Section 635 violation, Google’s motion to
dismiss Count III is denied.
6
D.
7
Google argues that plaintiffs’ federal Wiretap Act claim should be dismissed because
Count IV: Wiretap Act (18 U.S.C. § 2510, et seq.)
8
plaintiffs have not adequately alleged intent, because Google is merely acting as a vendor and is
9
not “intercepting” communications, and because the websites consented to data collection. The
10
intent and vendor liability arguments are the same as Google’s arguments against the California
11
Invasion of Privacy Act claims and are rejected for the same reasons. With respect to consent,
12
Google argues that because the tax sites “chose to use Google Analytics, they obviously consented
13
to it.” But this argument draws a crucial inference in Google’s favor—that in addition to installing
14
Google Analytics, website operators understood how the software works and what data would be
15
sent to Google and fully consented to that transmission. The complaint alleges that Google
16
purportedly prohibited sending personal information via Google Analytics but nevertheless
17
allowed such information to be transmitted (to its benefit). Taking this as true, the Court cannot
18
presume that every website owner who installed Google Analytics understood exactly what data
19
would be sent to Google and how Google might use it. Whether developers consented to data
20
collection by using Google Analytics is a fact dispute that cannot be resolved at this stage.
21
Accordingly, Google’s motion to dismiss Count IV is denied.
22
E.
23
18 U.S.C. § 2512(1)(b) is similar to Section 635. It makes punishable any person who
Count V: Wiretap Act (18 U.S.C. § 2512)
24
“intentionally … manufactures, assembles, possesses, or sells any electronic, mechanical, or other
25
device, knowing or having reason to know that the design of such device renders it primarily
26
useful for the purpose of the surreptitious interception of wire, oral, or electronic communications,
27
and that such device or any component thereof has been or will be sent through the mail or
28
transported in interstate or foreign commerce.” 18 U.S.C. § 2512(1)(b). Section 2520, in turn,
12
1
provides that “any person whose wire, oral, or electronic communication is intercepted, disclosed,
2
or intentionally used in violation of this chapter may in a civil action recover from the person or
3
entity, other than the United States, which engaged in that violation.”
Google raises the same arguments against the federal Section 2512 claim as the California
4
5
Section 635 claim. The consent and device-design arguments are rejected for the same reasons.
6
And as the Court has previously concluded, “Section 2520 at the very least provides a private
7
cause of action to enforce Section 2512(1)(b) against a defendant who also played an active role in
8
the unlawful interception, disclosure, or use of the plaintiff's communication.” 2024 WL 1251350,
9
at *12. Here, as in Meta Pixel, plaintiffs allege that Google not only created Google Analytics but
United States District Court
Northern District of California
10
also played an active role in its use to collect data from tax site users. See, e.g., Compl. ¶ 28.
11
Google also argues that plaintiffs have failed to plausibly allege that Google knew that
12
Google Analytics could be primarily used for a criminal purpose, as required under the federal
13
statute. But plaintiffs allege that Google furnished Google Analytics “with knowledge that it
14
would primarily be used to illegally intercept electronic communications.” Compl. ¶ 182. Google
15
argues that this allegation cannot be plausible in the face of Google’s policies purporting to require
16
that developers disclose their use of Google Analytics and obtain user consent. But this too
17
requires making factual determinations and drawing inferences in Google’s favor that go beyond
18
the pleadings and materials subject to judicial notice. Indeed, as the Court concluded in Meta
19
Pixel, “although disclosures about how [a tool] collects data might support a conclusion that
20
collection was not surreptitious, the fact that additional disclosures not inherent to the device’s
21
design are necessary to warn tracked individuals about how it works might also indicate that the
22
[tool’s] design does render it useful for surreptitious collection.” 2024 WL 1251350, at *11. Here,
23
too, the plaintiffs’ allegations regarding knowledge and intent are sufficient at the Rule 12(b)(6)
24
stage.
25
Accordingly, Google’s motion to dismiss Count V is denied.
26
F.
27
The Florida Security of Communications Act provides a civil cause of action for criminal
28
Count VI: Florida Security of Communications Act (Fla. Stat. § 934.10)
wiretap violations. Fla. Stat. §§ 934.03, 934.10. Google repeats its consent and vendor arguments,
13
United States District Court
Northern District of California
1
which are rejected for the reasons discussed above. The motion to dismiss Count VI is denied.
2
G.
3
The Illinois eavesdropping statute provides that “[a] person commits eavesdropping when
Count VII: Illinois Eavesdropping Statute (720 Ill. Comp. Stat. 5/14)
4
he or she knowingly and intentionally … [i]ntercepts, records, or transcribes, in a surreptitious
5
manner, any private electronic communication to which he or she is not a party unless he or she
6
does so with the consent of all parties to the private electronic communication.” 720 Ill. Comp.
7
Stat. 5/14-2(a). Google’s consent, intent, and vendor-liability arguments are again rejected. Google
8
also argues that the complaint fails to allege intentional interception “in a surreptitious manner” as
9
required. But the complaint alleges that the Google Analytics tracking code is “invisible” and was
10
used to “quietly transmit[]” plaintiffs’ sensitive financial information to Google. Compl. ¶¶ 25, 32.
11
This is enough to state a claim. Whether Google or the tax sites disclosed their use of Google
12
Analytics to plaintiffs in a manner that rendered it not surreptitious is a factual issue that cannot be
13
resolved on the pleadings. The motion to dismiss Count VII is therefore denied.
14
H.
15
Google raises the same arguments against the Texas claims as the federal wiretap claims,
16
and they are rejected for the same reasons. The motion to dismiss Count VII is therefore denied.
17
V.
18
19
20
21
Count VIII: Texas Wiretap Statute (Tex. Penal Code § 16.02)
Conclusion
For the reasons set forth above, Google’s requests for judicial notice are granted and its
motion to dismiss is denied.
Pursuant to the parties’ stipulation, the initial case management conference is reset for June
27, 2024. The parties shall submit a joint case management statement by June 13, 2024.
22
23
24
IT IS SO ORDERED.
Dated: June 3, 2024
25
26
P. Casey Pitts
United States District Judge
27
28
14
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?