Jackson v. LinkedIn Corporation

Filing 73

ORDER granting 60 Motion to Dismiss. Signed by Judge P. Casey Pitts on 1/3/2025. (nmc, COURT STAFF) (Filed on 1/3/2025)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
JACQUELINE JACKSON,

7

Plaintiff,

8

ORDER GRANTING MOTION TO
DISMISS

v.

9

Re: Dkt. No. 60

LINKEDIN CORPORATION,

10

Defendant.

11

United States District Court
Northern District of California

Case No. 5:24-cv-00812-PCP

12

Plaintiff Jacqueline Jackson brings this putative class action against defendant LinkedIn

13

Corporation, alleging that LinkedIn used its Insight Tag to unlawfully obtain and use personal

14

information from LinkedIn users visiting the California Department of Motor Vehicles website.

15

LinkedIn moves to dismiss Jackson’s claim under the federal Drivers’ Privacy Protection Act

16

(DPPA) for failure to state a claim, and argues that, if the Court dismisses that claim, it should

17

decline to exercise supplemental jurisdiction over her state law claims. For the following reasons,

18

the Court grants LinkedIn’s motion to dismiss the DPPA claim with prejudice and orders the

19

parties to show cause why Jackson’s state law claims should or should not be dismissed without

20

prejudice in the absence of any remaining federal question.

21

BACKGROUND

22

Jackson is a California resident who has been a registered LinkedIn user for at least 10

23

years.1 Jackson has an online account with the DMV, called a “MyDMV” account. Jackson

24

submitted personal information, including her name, phone number, and email address, to the

25

DMV in order to create her MyDMV account.

26
27
28

For the purposes of LinkedIn’s Rule 12(b)(6) motion, the Court assumes the truth of the
allegations in Jackson’s first amended complaint.
1

United States District Court
Northern District of California

1

Jackson has had a disability parking placard issued by the DMV since approximately 2009.

2

In 2023, Jackson used her mobile phone to renew her placard through the DMV’s website, which

3

required that she provide her first and last name, date of birth, disability information, and email

4

address. She was signed into her MyDMV account throughout the process of renewing her

5

placard. She alleges that in January 2024, she discovered that LinkedIn was using its Insight Tag

6

to obtain her personal information from her MyDMV account and to learn the contents of her

7

communications with the DMV in connection with her placard renewal.

8

LinkedIn’s Insight Tag is used to gather information across websites to support marketing

9

services that LinkedIn offers to its customers, including targeted advertising. Customers like the

10

DMV can install the Insight Tag on their own webpages to track a user’s actions on their website.

11

Jackson alleges that personal information and private communications are transmitted to LinkedIn,

12

incorporated into the user’s LinkedIn profile, and employed for targeted advertising. Jackson

13

alleges that LinkedIn used the information it received from the DMV “to generate substantial

14

revenue from advertising and marketing services.”

15

In her original complaint, Jackson alleged that LinkedIn’s conduct violates the DPPA and

16

the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 630. LinkedIn moved to dismiss

17

the case, arguing under Rule 12(b)(7) that the complaint failed to join the DMV as a necessary

18

party and under Rule 12(b)(6) that Jackson failed to state a valid claim. On August 13, 2024, the

19

Court granted LinkedIn’s motion to dismiss in part. The Court denied the 12(b)(7) motion and

20

denied the 12(b)(6) motion as to the CIPA claim but granted it as to the DPPA claim. The Court

21

concluded that Jackson had failed to plausibly allege that the personal information LinkedIn

22

purportedly obtained through the Insight Tag came from a motor vehicle record.

23
24

On September 3, 2024, Jackson filed a first amended complaint asserting the same claims.
LEGAL STANDARD

25

Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain

26

statement of the claim showing that the pleader is entitled to relief.” If the complaint does not do

27

so, the defendant may move to dismiss the complaint under Federal Rule of Civil Procedure

28

12(b)(6). Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the
2

1

reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556

2

U.S. 662, 678 (2009). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint

3

lacks a cognizable legal theory or sufficient facts to support a cognizable legal

4

theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To

5

survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief

6

that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007).
In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the

United States District Court
Northern District of California

7
8

complaint as true and construe the pleadings in the light most favorable” to the non-moving

9

party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009). While legal

10

conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct

11

unless adequately “supported by factual allegations.” Iqbal, 556 U.S. at 679. Courts do not “accept

12

as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable

13

inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell

14

v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)).
ANALYSIS

15
16
17

I.

Jackson fails to state a claim under the DPPA.
To establish a potential violation of the DPPA, a plaintiff must plausibly allege that the

18

defendant: (1) knowingly took some affirmative action to obtain, disclose, or use personal

19

information (2) from a motor vehicle record (3) for an impermissible purpose. 18 U.S.C. § 2721;

20

Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1259 (9th Cir. 2019). Personal information is

21

information that “identifies an individual, including an individual’s photograph, social security

22

number, driver identification number, name, address (but not the 5-digit zip code), telephone

23

number, and medical or disability information.” 18 U.S.C. § 2725(3). A motor vehicle record is a

24

record maintained by the DMV pertaining to a driver’s operating permit, title, registration, or

25

identification card. 18 U.S.C. § 2725(1).

26

Accordingly, in order to state a DPPA claim, Jackson must allege that the information

27

transmitted to LinkedIn via the Insight Tag was personal information, as defined by 18 U.S.C. §

28

2725(3), and that it came from a DMV record. Although Jackson adequately alleges that the
3

United States District Court
Northern District of California

1

Insight Tag transmitted personal information to LinkedIn, she does not allege facts sufficient to

2

show that the information came from a motor vehicle record.

3

A.

4

Much of the information that the Insight Tag purportedly transmits from the California

Personal information

5

DMV website to LinkedIn is not personal information within the meaning of 18 U.S.C. § 2725(3).

6

Jackson alleges the Insight Tag transmits URLs, the fact that a particular button has been clicked,

7

and browser cookies that match website user interactions with LinkedIn members. Most URLs and

8

buttons do not contain personal information, which is defined as information that identifies an

9

individual. Jackson alleges, for example, that when a MyDMV user changes their phone number,

10

the Insight Tag transmits to LinkedIn the fact that a “Change Phone Number” button has been

11

clicked and that the user has visited the URL “https://www.dmv.ca.gov/portal/update-your-phone-

12

number/.” Neither of those pieces of information is personal information because neither identifies

13

the user.

14

Nevertheless, some of the information that the Insight Tag allegedly transmits does fall

15

within the definition of personal information under 18 U.S.C. § 2725(3). Jackson alleges that

16

when she renewed her disability parking placard, the Insight Tag transmitted the full text of a URL

17

revealing that she was going through the placard renewal process (thus disclosing her disability).

18

Disability information is expressly defined as personal information under 18 U.S.C. § 2725(3).

19

Likewise, Jackson alleges that the Insight Tag transmitted her email address to LinkedIn, and

20

“email addresses fall within the ordinary meaning of information that identifies an individual

21

because they can prove or establish the identity of an individual and … often expressly include the

22

account holder’s name, affiliated organization, or other identifying information.” Gershzon v.

23

Meta Platforms, Inc., No. 23-CV-00083-SI, 2023 WL 5420234 at *5 (N.D. Cal. Aug. 22, 2023)

24

(cleaned up) (quoting United States v. Hastie, 854 F.3d 1298, 1303 (11th Cir. 2017)).

25
26

Accordingly, Jackson has adequately alleged that the Insight Tag transmitted her personal
information to LinkedIn.

27

B.

28

Although Jackson has plausibly alleged that her personal information was transmitted to

From a motor vehicle record

4

1

LinkedIn via the Insight Tag, she has not adequately alleged that this personal information came

2

from a motor vehicle record. Nearly all of the personal information that Jackson alleges was

3

transmitted to LinkedIn came from Jackson herself, and, as the Court held in its prior order

4

granting in part LinkedIn’s motion to dismiss, information that Jackson herself entered into the

5

DMV’s website is not a motor vehicle record. While the personal information that was purportedly

6

transmitted may have been identical to information contained in a motor vehicle record, it did not

7

come from that motor vehicle record. “[W]here, as here, the initial source of personal information

8

is a record in the possession of an individual, rather than a state DMV, then use or disclosure of

9

that information does not violate the DPPA.” Andrews, 932 F.3d at 1260.

United States District Court
Northern District of California

10

Andrews is illustrative. In that case, Sirius XM Radio obtained the plaintiff’s name and

11

address from a car dealer, who obtained that information from the plaintiff’s driver’s license. The

12

Court held that a driver’s license is not a motor vehicle record within the meaning of the DPPA

13

because “though issued by the DMV, [it] becomes the possession of an individual, not the DMV

14

that issued it.” Id. The Court concluded that obtaining information that is also contained in a motor

15

vehicle record from an independent source does not violate the DPPA. As the court explained,

16

construing the scope of the DPPA as limited to information taken directly from a motor vehicle

17

record is consistent with the statute’s purpose to prevent DMVs from releasing and selling drivers’

18

personal information. Id. at 1259–61.

19

Jackson alleges that, in order to apply for a disability parking placard on the DMV website,

20

an individual must click a “Start Application” button, which takes them to a webpage containing

21

forms they must complete. She alleges that the URL of this webpage, which contains the text

22

“dpp-application-form,” is transmitted to LinkedIn by the Insight Tag. Jackson alleges that

23

“similar information” was transmitted when she renewed her placard. While the text “dpp-

24

application-form” indicates that an individual is seeking to obtain a disability parking placard, and

25

thus constitutes disability information (which is personal information under 18 U.S.C. § 2725(3)),

26

the URL allegedly transmitted when Jackson renewed her placard came from Jackson’s

27

interactions with the DMV website, not a DMV motor vehicle record.

28

Jackson also alleges that after placard applicants submit their applications, they receive a
5

1

confirmation email from the DMV containing a “status checker” button. When an applicant clicks

2

that button, they are allegedly prompted to enter their email address and case number.2 They are

3

then allegedly redirected to a DMV webpage, and a URL containing their email address is

4

transmitted to LinkedIn. Once again, however, the email address in that URL is generated through

5

the applicant’s interactions with the webpage and the information they enter themselves. Just as

6

Andrews held that obtaining personal information from a driver’s license that was also stored in

7

the DMV’s records did not constitute obtaining information from a motor vehicle record,

8

obtaining information that Jackson herself entered on the DMV website does not constitute

9

obtaining information from a motor vehicle record, whether or not that information also “exist[s]

10

in the DMV’s database,” as Jackson puts it.
The only personal information allegedly transmitted via the Insight Tag that came from the

United States District Court
Northern District of California

11
12

DMV itself rather than from Jackson and her interactions with the DMV website was her first

13

name, which appeared on a button on the DMV website after she created and logged into her

14

MyDMV account.3 Jackson alleges that after an individual creates a MyDMV account, the DMV

15

uses their first name, as listed in a DMV database, on the button used to access the MyDMV

16

portal. When a MyDMV user clicks that button, their first name is allegedly transmitted to

17

LinkedIn.

18
19
20
21
22
23
24
25
26
27
28

2

Although Jackson alleges generally that placard applicants receive confirmation emails
containing “status checker” buttons, she does not allege that she ever received such an email or
clicked the button.
3
LinkedIn argues that a first name is not personal information for purposes of the DPPA even
though the statute defines personal information to include a “name” and a first name is
undoubtedly a “name.” While the Court need not resolve this question definitively given its
holding that Jackson has not alleged that LinkedIn received her first name from a motor vehicle
record, the Court notes that multiple other courts have held that similarly nonspecific information,
such as height, weight, hair color, and eye color, falls within the definition of personal information
under 18 U.S.C. § 2725(3). See Gershzon, 2023 WL 5420234, at *6; Dahlstrom v. Sun-Times
Media, LLC, 777 F.3d 937 (7th Cir. 2015). Medical and disability information are also expressly
covered by the DPPA even though they are not particularly specific. As the court explained in
Gershzon, an expansive reading of “personal information” serves the public safety purpose of the
DPPA because “although a potential stalker would likely require information beyond hair and eye
color to positively identify his victims, details regarding any pertinent physical feature would
make such identification easier.” 2023 WL 5420234, at *6; see also United States v. Hastie, 854
F.3d 1298, 1304 (11th Cir. 2017) (“The term ‘personal information’ should be read naturally to
include facts that can identify an individual, as opposed to facts that in every instance must
identify an individual.”).
6

This Court previously explained that information on a public-facing DMV website cannot

United States District Court
Northern District of California

1
2

be a motor vehicle record because a record consists of “information about an individual that is

3

maintained by an agency,” but it noted that a MyDMV account is at least arguably maintained by

4

an agency for the purposes of the DPPA. But while maintenance by an agency is a necessary

5

condition for any DPPA claim, it is not sufficient because not all information maintained by an

6

agency falls within the definition of motor vehicle record. For the purposes of the DPPA, motor

7

vehicle records include only records pertaining to a driver’s operating permit, title, registration, or

8

identification card. 18 U.S.C. § 2725(1).

9

It is certainly possible that records within a user’s MyDMV account might fall within this

10

definition.4 Jackson, however, has not adequately alleged that her first name, as maintained by the

11

DMV in connection with her MyDMV account, specifically pertains to a driver’s operating

12

permit, title, registration, or identification card. To the contrary, Jackson alleges that she provided

13

her first name to the DMV in order to establish that account and access the MyDMV portal.

14

Notably, any internet user with an email address and phone number can create a MyDMV account,

15

whether or not they ever intend to apply for an operating permit, title, registration, or identification

16

card.5 Jackson’s first name as displayed on the button on the DMV website came from a record

17

maintained by the DMV for the purposes of allowing website access, not in relation to any license,

18

placard, or vehicle title it issued to her.
Jackson notes that the DMV “advises individuals to ‘use the name that will appear on your

19
20

driver’s license or identification card’” when they create their MyDMV account. As a result, the

21

first name on the button associated with their account is likely to be the same as the first name on

22
23
24
25
26
27

If the MyDMV portal displayed information taken directly from the DMV’s database of licensed
drivers or vehicle titles, for example, that information might be obtained “from a motor vehicle
record” for DPPA purposes.
5
The Court takes judicial notice of the existence and contents of the California DMV website and
the MyDMV registration process. See Am. Fed’n of Tchrs. v. DeVos, 484 F. Supp. 3d 731, 739
(N.D. Cal. 2020); Fed. R. Evid. 201 (permitting judicial notice of “a fact that is not subject to
reasonable dispute” because the fact is “generally known” or “can be accurately and readily
determined from sources whose accuracy cannot reasonably be questioned”).
4

28
7

1

their driver’s license or identification card. But, as explained above, information that is merely the

2

same as information contained within a motor vehicle record is not information that comes from a

3

motor vehicle record for DPPA purposes.
The DPPA applies only where a defendant has obtained personal information from a motor

United States District Court
Northern District of California

4
5

vehicle record, and Jackson again fails to allege that any personal information transmitted to

6

LinkedIn via the Insight Tag—whether from her MyDMV account or otherwise—was obtained

7

from such a record. Accordingly, the Court grants LinkedIn’s motion to dismiss Jackson’s

8

amended DPPA claim. Because Jackson has already had an opportunity to amend her complaint to

9

address this deficiency but has failed to do so, the Court’s dismissal of that claim is with prejudice

10

and without leave to amend.

11

II.

12
13

The parties are ordered to show cause why the Court has or does not have CAFA
jurisdiction over Jackson’s CIPA claim.
LinkedIn argues that, if Jackson’s federal claim is dismissed, the Court should decline to

14

exercise supplemental jurisdiction over her remaining state law claim under the California

15

Invasion of Privacy Act. Jackson, however, contends both that the Court should exercise its

16

supplemental jurisdiction notwithstanding the absence of a federal claim and that this Court has

17

jurisdiction over her CIPA claim under the Class Action Fairness Act (CAFA), 28 U.S.C. §

18

1332(d)(2).

19

There is no question that this Court initially had federal question jurisdiction over this

20

lawsuit under 28 U.S.C. § 1331 because Jackson was pursuing a claim under a federal statute.

21

Without the DPPA claim, only her state law CIPA claim remains. The Court nonetheless retains

22

supplemental jurisdiction over her state law claim under 28 U.S.C. § 1367(a) because the “state

23

and federal claims … derive from a common nucleus of operative fact.” See Gibbs, 383 U.S. at

24

725. Whether to exercise that jurisdiction is a discretionary matter. Satey v. JPMorgan Chase &

25

Co., 521 F.3d 1087, 1091 (9th Cir. 2008); 28 U.S.C. § 1367(c)(3) (“The district courts may

26

decline to exercise supplemental jurisdiction over a claim … if … the district court has dismissed

27

all claims over which it has original jurisdiction.”).

28

In making that determination, courts “must ‘consider and weigh in each case, and at every
8

United States District Court
Northern District of California

1

stage of the litigation, the values of judicial economy, convenience, fairness, and comity.’” Lenk v.

2

Monolithic Power Sys., Inc., 2017 WL 4586832, at *2 (N.D. Cal. June 1, 2017) (quoting Gibbs,

3

383 U.S. at 726). The stage of the litigation is a central consideration in weighing these values.

4

“[J]udicial economy and convenience … weigh less heavily early in a case.” Gastelum v. TJX

5

Companies, Inc., No. 21-CV-06714-VKD, 2023 WL 2224432, at *2 (N.D. Cal. Feb. 24, 2023).

6

“[A] district court should generally decline the exercise of supplemental jurisdiction and dismiss a

7

case without prejudice when ‘the federal-law claims have dropped out of the lawsuit in its early

8

stages and only state law claims remain.’” Lenk, 2017 WL 4586832, at *2 (quoting Carnegie-

9

Mellon Univ. v. Cohill, 484 U.S. 343, 348 (1988)); see also Wren v. Sletten Constr. Co., 654 F.2d

10

529, 536 (9th Cir. 1981) (“When … all federal claims are dismissed before trial, the proper

11

exercise of discretion requires dismissal of the state claim.”). Here, the case remains in its early

12

stages. Although the parties have engaged in some discovery, the case has not proceeded past the

13

pleadings and it is still nearly two years away from trial.6 It would not be especially burdensome

14

for a state court to familiarize itself with the facts here. Thus, while judicial economy and

15

convenience slightly disfavor dismissal simply because these proceedings are already underway,

16

these two factors carry minimal weight.

17

Fairness considerations weigh neither in favor of nor against dismissal. Both Jackson and

18

LinkedIn are California residents equally able to litigate in state or federal court, and Jackson has

19

not identified any prejudice that would result from having to refile her claims in state court.
While fairness is neutral and judicial economy and convenience only very slightly favor

20
21

exercising supplemental jurisdiction, comity concerns strongly weigh against doing so. Declining

22

to exercise this Court’s supplemental jurisdiction would allow the California state courts to

23

interpret and apply state law and to resolve a novel state law claim involving a class likely

24

composed primarily of Californians. In defining the limits of this Court’s diversity jurisdiction,

25

Congress demonstrated its intent for such claims to be pursued in state rather than federal court in

26
27
28

At the hearing on LinkedIn’s motion, LinkedIn suggested a willingness to allow the discovery
that has already taken place in this lawsuit to be used in any state court lawsuit Jackson might file
following dismissal.
9
6

1

most instances, and this Court generally must respect that judgment. Because these comity

2

concerns strongly outweigh any of the other relevant factors, it would be inappropriate for this

3

Court to exercise supplemental jurisdiction over Jackson’s CIPA claim in the absence of some

4

other basis for jurisdiction.

United States District Court
Northern District of California

5

Jackson contends that the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d)(2),

6

provides that alternative basis. CAFA provides that district courts have diversity jurisdiction over

7

class actions where the class has at least 100 class members, at least one plaintiff is a citizen of a

8

different state from at least one defendant, and the amount in controversy is greater than

9

$5,000,000. In her amended complaint, Jackson specifically alleges that at least one class member

10

is a citizen of a state where LinkedIn is not a citizen, that the class includes more than 100

11

members, and that the amount in controversy exceeds $5,000,000.

12

Although Jackson has pleaded the existence of CAFA jurisdiction, the Court has serious

13

concerns that CAFA’s “home state” exception precludes this Court from exercising CAFA

14

jurisdiction over Jackson’s CIPA claim. The home state exception provides that “a district court

15

shall decline to exercise jurisdiction … over a class action in which … greater than two thirds of

16

the members of all proposed plaintiff classes in the aggregate are citizens of the State in which the

17

action was originally filed.” 28 U.S.C. § 1332(d)(4). In this case, the putative class is defined as

18

LinkedIn members who applied for, renewed, or checked the status of a California disability

19

parking placard on the California DMV website. Under these circumstances, it seems likely that

20

the class is composed overwhelmingly of California citizens. Even if some putative class members

21

were never California citizens and some have the left the state and are no longer California

22

citizens, it seems unlikely that those individuals constitute over one third of the class.

23

Unfortunately, the existing evidentiary record is inadequate for the Court to make a final

24

determination as to whether the home state exception applies to Jackson’s CIPA claim. Because

25

this presents a threshold issue that should be resolved as early as possible in the litigation, the

26

Court orders the parties to file, within 21 days, supplemental briefs of no more than 10 pages,

27

along with any supporting evidence, addressing whether CAFA’s “home state” exception applies

28

to Jackson’s CIPA claim.
10

CONCLUSION

1
2

For the foregoing reasons, the Court grants LinkedIn’s motion to dismiss Jackson’s DPPA

3

claim. That claim is dismissed with prejudice and without leave to amend. The parties shall file

4

supplemental briefs and supporting evidence regarding CAFA’s home state exception within 21

5

days of this Order.

6
7
8

IT IS SO ORDERED.
Dated: January 3, 2025

9
10
P. Casey Pitts
United States District Judge

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
11