Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 1 of 21 Page ID #:105
`
`
`
`BURSOR & FISHER, P.A.
`L. Timothy Fisher (State Bar No. 191626)
`Joel D. Smith (State Bar No. 244902)
`1990 North California Boulevard, Suite 940
`Walnut Creek, CA 94596
`Telephone: (925) 300-4455
`Facsimile: (925) 407-2700
`E-Mail: ltfisher@bursor.com
`
` jsmith@bursor.com
`
`Attorneys for Plaintiff
`
`BURHAAN SALEH, individually and on
`behalf of all others similarly situated,
`
`
`Plaintiff,
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`CENTRAL DISTRICT OF CALIFORNIA
`
`
`
`
`Case No. 2:20-cv-09581-FMO-RAO
`
`FIRST AMENDED CLASS
`ACTION COMPLAINT
`
`JURY TRIAL DEMANDED
`
`v.
`
`
`
`
`
`
`NIKE, INC. and FULLSTORY, INC.,
`
`Defendants.
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 2 of 21 Page ID #:106
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Plaintiff Burhaan Saleh (“Plaintiff”), individually and on behalf of all others
`similarly situated, by and through his attorneys, makes the following allegations
`pursuant to the investigation of his counsel and based upon information and belief,
`except as to allegations specifically pertaining to himself and his counsel, which are
`based on personal knowledge.
`NATURE OF THE ACTION
`1.
`This is a class action suit brought against Defendants Nike, Inc.’s
`(“Nike”) and FullStory, Inc. (“FullStory”) (collectively, “Defendants”) for
`wiretapping the electronic communications of visitors to Defendant Nike’s website,
`Nike.com (the “Website”).1 The wiretaps, which are embedded in the computer code
`on the Website, are used by Defendants to secretly observe and record website
`visitors’ keystrokes, mouse clicks,2 and other electronic communications, including
`the entry of Personally Identifiable Information (“PII”), in real time. By doing so,
`Defendants have violated the California Invasion of Privacy Act (“CIPA”), Cal. Penal
`Code §§ 631 and 635, and invaded Plaintiff’s and Class Members’ privacy rights in
`violation of the California Constitution.
`2.
`In May 2020, Mr. Saleh visited the Website. During the visit,
`Defendants recorded Plaintiff’s electronic communications in real time, including
`Plaintiff’s mouse clicks, keystrokes, and payment card information.
`3.
`Plaintiff brings this action on behalf of himself and a class of all persons
`whose electronic communications were intercepted through the use of Defendants’
`wiretap on the Website.
`
`THE PARTIES
`4.
`Plaintiff Burhaan Saleh is a California citizen and resident who lives in
`Glendale, California. Mr. Saleh is domiciled and intends to remain in California. In
`
`1 NIKE, https://www.nike.com/.
`2 As used herein, the term “mouse clicks” also refers to “touch gestures” such as the
`“tap,” “swipe,” and similar gestures used on touchscreen devices.
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`1
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 3 of 21 Page ID #:107
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`May 2020, prior to the filing of this lawsuit, Mr. Saleh visited the Website and
`purchased shoes from the Website. Mr. Saleh was in Glendale when he visited the
`website. During the visit, Mr. Saleh’s keystrokes, mouse clicks, and other electronic
`communications—including the entry of his payment card information—were
`intercepted in real time and were disclosed to Defendants Nike and FullStory through
`the wiretap. Mr. Saleh was unaware at the time that his keystrokes, mouse clicks, and
`other electronic communications, including the information described above, were
`being intercepted in real-time and would be disclosed to FullStory, nor did Mr. Saleh
`consent to the same.
`5.
`Defendant Nike, Inc. is a company incorporated under the laws of
`Oregon with its principal place of business at One Bowerman Drive, Beaverton,
`Oregon 97005.
`6.
`Nike does business throughout California and the entire United States.
`7.
`Nike owns and operates the Website.
`8.
`Defendant FullStory is a Delaware corporation with its principal place of
`business at 1745 Peachtree Street Northwest, Suite G, Atlanta, Georgia 30309.
`9.
`FullStory is a marketing software-as-a-service (“SaaS”) company.
`10. FullStory provides a feature called “Session Replay,” which is at issue
`here and described more fully below. At all relevant times here, Nike has used
`FullStory’s “Session Replay” product on the Website.
`JURISDICTION AND VENUE
`11. This Court has subject matter jurisdiction pursuant to 28 U.S.C. §
`1332(d)(2)(A) because this case is a class action where the aggregate claims of all
`members of the proposed class are in excess of $5,000,000.00, exclusive of interest
`and costs, and at least one member of the proposed class is citizen of state different
`from at least one Defendant.
`12. This Court has personal jurisdiction over Defendants because each of the
`Defendants have purposefully availed themselves of the laws and benefits of doing
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`2
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 4 of 21 Page ID #:108
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`business in this State, and Plaintiff’s claims arise out of each of the Defendants’
`forum-related activities. Furthermore, a substantial portion of the events giving rise
`to Plaintiff’s claims occurred in this District.
`13. Pursuant to 28 U.S.C. § 1391, this Court is the proper venue for this
`action because a substantial part of the events, omissions, and acts giving rise to the
`claims herein occurred in this District.
`14. Both Defendants also purposefully directed their activities at California,
`and the wiretapping at issue here arises from or relates to Defendants’ activities. As
`alleged more fully below, Defendants intentionally installed the wiretap at issue here
`on Nike’s Website. Defendant FullStory purposefully intercepted electronic
`transmissions from users of Nike’s website, and Nike purposefully aided and abetted
`FullStory’s conduct. The conduct also was expressly aimed at California residents.
`California is the largest market in the United States—indeed, if California were its
`own nation, California would have the fifth largest economy in the world.
`Defendants knew that a significant number of Californians would visit Nike’s
`website, because they form a significant portion of Nike’s customer base. By
`intercepting the transmissions of Nike website users, Defendants targeted their
`wrongful conduct at customers, some of whom Defendants knew, at least
`constructively, were residents of California. It was foreseeable that Defendants’
`interceptions and wiretapping would harm Plaintiff and similarly-situated individuals,
`and that at least some of this harm would occur in California—where Defendants
`knew many customers and prospective customers resided.
`STATEMENT OF FACTS
`Overview Of The Wiretaps
`15. Defendant FullStory develops a software of the same name that provides
`marketing analytics.
`16. One of FullStory’s features is called “Session Replay.”
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`I.
`
`3
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 5 of 21 Page ID #:109
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`17. FullStory says that “Session replay tools capture things like mouse
`movements, clicks, typing, scrolling, swiping, tapping, etc.” on a given website.
`18. Session replay technologies work by using “embedded snippets of code
`… [that] watch and record a visitor’s every move on a website, in real time.”3
`19. FullStory touts that Session Replay relies on real video of a user’s
`interactions with a website, or, in another words, a “recorded session.”4
`20. To demonstrate how Session Replay works, FullStory displays the
`“recorded session of a fictional user interacting with th[e] [Session Replay] Guide”:
`
`
`21. FullStory describes the above video as follows:
`
`
`3 Tomas Foltyn, What’s the Deal with Session-Replay Scripts?, WELIVESECURITY,
`Apr. 20, 2018, https://www.welivesecurity.com/2018/04/20/whats-deal-session-
`replay-scripts/.
`4 https://www.fullstory.com/resources/the-definitive-guide-to-session-replay/.
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`4
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 6 of 21 Page ID #:110
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Here you can watch a FullStory session replay of a user—
`Daniel Falko—flipping through The Definitive Guide to
`Session Replay. Notice how you can see interactions, mouse
`movements, clicks, interactions with overlays, and more—
`and everything is listed in order in a stream at the right side
`of the replay. This is what a session replay looks like in the
`FullStory app.5
`22. FullStory’s promotional video shows the behind-the-scenes features of
`the software. First, FullStory lets you view a list of users who visited the website, as
`
`well as the time they spent on the website:
`
`23. Upon clicking one of these “sessions,” FullStory lets a company view
`the video of a user’s interaction with a website, including mouse movements, clicks,
`interactions with overlays, keystrokes, geographic location, IP address, and more “to
`see the real customer experience behind the data”:
`//
`//
`//
`
`
`5 https://www.FullStory.com/resources/the-definitive-guide-to-session-
`replay/#finding-the-right-session-replay-tool (emphasis added).
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`5
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 7 of 21 Page ID #:111
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`24. FullStory instructs prospective partners that “[t]he first step toward
`recording all in-browser interactions and making them available for pixel-perfect
`playback is deploying FullStory’s recording JavaScript snippet. Simply paste the
`snippet into the <head> element via your Content Management System (CMS), via
`your online store platform, or via your application’s code.”
`25. This snippet of code allows Defendants to record the keystrokes, mouse
`clicks, data entry, and other electronic communications of visitors to websites where
`the code is installed. It also allows Defendants to track the amount of time spent on
`the website, geographic location of the visitor, and other information described
`above.
`26. FullStory’s code is not a cookie at all, much less a run-of-the-mill
`cookie. Common cookies that consumers might be familiar with do not engage in
`session recording or all of the features described above. FullStory’s code does far
`more than simply track where a visitor went on the internet, and its functionality is
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`6
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 8 of 21 Page ID #:112
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`not limited to aggregate data. Rather, as a 2017 study by Princeton University
`researchers—which specifically examined FullStory—noted, “unlike typical analytics
`services that provide aggregate statistics, these scripts are intended for the recording
`and playback of individual browsing sessions, as if someone is looking over your
`shoulder.”
`27. When the website user’s communications are transmitted to Nike’s
`Website, FullStory records the website user’s interactions locally in the user’s
`browser in real time, and then transmits that information to FullStory’s recording
`servers every few seconds. FullStory then makes the information available to its
`clients.
`28. FullStory not only records users’ electronic communications in real time
`for later viewing, but also allows websites to monitor them live. “For sessions that
`are actively recording and we are still receiving events from a user (meaning the last
`page in their session is still open), you’ll see a ‘Go Live’ button at the end of the
`playback bar. Once you click on the button, you’ll essentially be riding along in near
`real time with the user with no need to refresh the playback.”
`29. The 2017 study by Princeton University researchers shows this process
`in action. In the first screenshot below, a mock user visits a website and enters
`information:
`//
`//
`//
`//
`//
`//
`//
`//
`//
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`7
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 9 of 21 Page ID #:113
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`30.
`In the second screenshot, one can see FullStory’s dashboard.6 The
`information is simultaneously recorded by FullStory, and less than a second later, the
`user’s actions can be seen in FullStory’s recording:
`//
`
`
`6 These two images are displayed side-by-side in the study. Plaintiff has separated
`the two images so that they can be made larger for clarity.
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`8
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 10 of 21 Page ID #:114
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`31. The “Go Live” feature is always available as long as a user’s website
`session is active, meaning FullStory is always recording a user’s interactions with a
`website in real time, regardless of whether the video is viewed in real time.
`32. FullStory’s recording is not limited to desktop website, but also mobile
`websites and mobile applications.7
`33. Technology like FullStory’s Session Replay feature is not only highly
`
`7 https://www.fullstory.com/mobile-apps/.
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`9
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 11 of 21 Page ID #:115
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`intrusive, but dangerous. The 2017 study by Princeton University researchers found
`that session recording technologies were collecting sensitive user information such as
`passwords and credit card numbers. The research notes that this wasn’t simply the
`result of a bug, but rather insecure practices. Thus, session recording technologies
`such as FullStory’s can leave users vulnerable to data leaks and the harm resulting
`therefrom.
`34. FullStory’s business model involves entering into voluntary partnerships
`with various companies and providing their software to their partners.
`35. One of FullStory’s partners is Defendant Nike.
`36. Nike utilizes FullStory’s software on the Website.
`37. Nike knows that FullStory’s software captures the keystrokes, mouse
`clicks and other communications of visitors to its website, and pays FullStory to
`supply that information.
`38. Pursuant to an agreement with FullStory, Nike enabled FullStory’s
`software by voluntarily embedding FullStory’s software code on the Website.
`39. As currently deployed, FullStory’s software, as employed by Nike,
`functions as a wiretap.
`II. Defendants Wiretapped Plaintiff’s Electronic Communications
`40.
`In May 2020, Mr. Saleh visited Nike.com and made a purchase.
`41. During that visit, and upon information and belief, the Session Replay
`feature in FullStory’s software created a video capturing each of Plaintiff’s
`keystrokes and mouse clicks on the website. The FullStory wiretap also captured the
`date and time of the visit, the duration of the visit, Plaintiff’s IP address, his location
`at the time of the visit, his browser type, and the operating system on his device.
`42. FullStory’s recording of keystrokes, mouse clicks, data entry, and other
`electronic communications begins the moment a user accesses or interacts with the
`Website.
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`10
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 12 of 21 Page ID #:116
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`43. When users access the Website and make a purchase, they enter their
`PII. FullStory’s software captures these electronic communications throughout each
`step of the process. Even if users do not complete the form, the Website nonetheless
`captures users’ electronic communications throughout his or her visit.
`44. On Nike’s website, FullStory’s software captures, among other things:
`(a) The user’s mouse clicks;
`(b) The user’s keystrokes;
`(c) The user’s payment card information, including card number,
`expiration date, and CVV code;
`(d) The user’s IP address;
`(e) The user’s location at the time of the visit; and
`(f) The user’s browser type and the operating system on their
`devices.
`45. Crucially, Defendant Nike does not ask users, including Plaintiff,
`whether they consent to being wiretapped by FullStory. Users are never told that
`their electronic communications are being wiretapped by FullStory.
`46. Nike’s Privacy Policy did not disclose the wiretapping for two reasons.
`First, to the extent Nike’s home page contained a link to the Privacy Policy, it was
`buried at the very bottom of the webpage in tiny, 7.5 non-contrasting font that was
`designed to be unobtrusive and easy to overlook. Further, even though users are
`presented with a hyperlink to Nike’s Privacy Policy at the checkout process, Nike
`began recording users long before this moment, i.e., any purported disclosure was
`made after the wiretap had already begun.
`47. Moreover, users are not on notice of the hyperlink to the Privacy Policy
`when they click the “Place Order” button.
`48. Second, even if users do agree to the Privacy Policy by using the
`Website or otherwise—and they do not for the reasons stated above—Nike does not
`mention FullStory or its Session Replay feature in Nike’s Privacy Policy. At best,
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`11
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 13 of 21 Page ID #:117
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`the Privacy Policy discusses Nike’s use of “Cookies and Pixel Tags” to collect
`information, not that users are actively having their website sessions recorded in real
`time. Indeed, unlike Nike, other companies actively disclose the use of session
`recording technology on their websites by implementing a pop-up screen that a user
`must acknowledge before advancing further on the website. That practice goes to
`show that companies know how to disclose the use of session recording technology
`when they want to.
`49. Further, Nike states in its Privacy Policy that Nike may use “cookies and
`pixel trackers” to collect “click behavior.” But this does not disclose the wiretapping
`for several reasons. First, Nike only discloses that it—and not a third party—may
`collect “click behavior.” Second, disclosing that Nike has the capacity to monitor
`certain information is not the same as disclosing that it does in fact collect mouse
`clicks, keystrokes, and other communications in real time. And third, a reasonable
`consumer might suspect that Nike keeps track of what that consumer purchases after
`the fact for marketing purposes. But a reasonable consumer would not expect to
`have their mouse clicks, keystrokes, and other communications monitored by a third
`party in real time and conglomerated into a video recording, whether or not that user
`made a purchase. Indeed, as the 2017 Princeton University study researchers
`recognized, “the extent of data collected by these services far exceeds user
`expectations [1]; text typed into forms is collected before the user submits the form,
`and precise mouse movements are saved, all without any visual indication to the user.
`This data can’t reasonably be expected to be kept anonymous.”
`50. For these reasons and more, users do not agree to be wiretapped even if
`they agree to the Privacy Policy.
`51. Neither Plaintiff nor any Class member consented to being wiretapped
`on the Website, nor to have their communications recorded and shared with
`FullStory. Any purported consent that was obtained was ineffective because (i) the
`wiretapping began from the moment Plaintiff and Class members accessed the
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`12
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 14 of 21 Page ID #:118
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Website; (ii) the Privacy Policy did not disclose the wiretapping or FullStory; and
`(iii) the hyperlink to the Privacy Policy is inconspicuous and therefore insufficient to
`provide notice.
`
`CLASS ACTION ALLEGATIONS
`52. Plaintiff seeks to represent a class of all California residents who visited
`the Website, and whose electronic communications were intercepted or recorded by
`FullStory. Plaintiff reserves the right to modify the class definition as appropriate
`based on further investigation and discovery obtained in the case.
`53. Members of the Class are so numerous that their individual joinder
`herein is impracticable. On information and belief, members of the Class number in
`the thousands. The precise number of Class members and their identities are
`unknown to Plaintiff at this time but may be determined through discovery. Class
`members may be notified of the pendency of this action by mail and/or publication
`through the distribution records of Defendants.
`54. Common questions of law and fact exist as to all Class members and
`predominate over questions affecting only individual Class members. Common legal
`and factual questions include, but are not limited to, whether Defendants have
`violated the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631 and
`invaded Plaintiff’s privacy rights in violation of the California Constitution; and
`whether class members are entitled to actual and/or statutory damages for the
`aforementioned violations.
`55. The claims of the named Plaintiff are typical of the claims of the Class
`because the named Plaintiff, like all other class members, visited the Website and had
`his electronic communications intercepted and disclosed to FullStory through the use
`of FullStory’s wiretaps.
`56. Plaintiff is an adequate representative of the Class because his interests
`do not conflict with the interests of the Class members he seeks to represent, he has
`retained competent counsel experienced in prosecuting class actions, and he intends
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`13
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 15 of 21 Page ID #:119
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`to prosecute this action vigorously. The interests of Class members will be fairly and
`adequately protected by Plaintiff and his counsel.
`57. The class mechanism is superior to other available means for the fair and
`efficient adjudication of the claims of Class members. Each individual Class member
`may lack the resources to undergo the burden and expense of individual prosecution
`of the complex and extensive litigation necessary to establish Defendants’ liability.
`Individualized litigation increases the delay and expense to all parties and multiplies
`the burden on the judicial system presented by the complex legal and factual issues of
`this case. Individualized litigation also presents a potential for inconsistent or
`contradictory judgments. In contrast, the class action device presents far fewer
`management difficulties and provides the benefits of single adjudication, economy of
`scale, and comprehensive supervision by a single court on the issue of Defendants’
`liability. Class treatment of the liability issues will ensure that all claims and
`claimants are before this Court for consistent adjudication of the liability issues.
`58. Plaintiff brings all claims in this action individually and on behalf of
`members of the Class against Defendants.
`COUNT I
`Violation Of The California Invasion Of Privacy Act,
`Cal. Penal Code § 631
`59. Plaintiff repeats the allegations contained in the foregoing paragraphs as
`if fully set forth herein.
`60. Plaintiff brings this claim individually and on behalf of the members of
`the proposed Class against Defendants.
`61. To establish liability under section 631(a), Plaintiff need only establish
`that Defendants, “by means of any machine, instrument, contrivance, or in any other
`manner,” did any of the following:
`Intentionally taps, or makes any unauthorized connection,
`whether physically, electrically, acoustically, inductively or
`otherwise, with any telegraph or telephone wire, line, cable,
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`14
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 16 of 21 Page ID #:120
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`or instrument, including the wire, line, cable, or instrument
`of any internal telephonic communication system,
`
`Or
`Willfully and without the consent of all parties to the
`communication, or in any unauthorized manner, reads or
`attempts to read or learn the contents or meaning of any
`message, report, or communication while the same is in
`transit or passing over any wire, line or cable or is being
`sent from or received at any place within this state,
`
`Or
`Uses, or attempts to use, in any manner, or for any purpose,
`or to communicate in any way, any information so
`obtained,
`
`Or
`
`Aids, agrees with, employs, or conspires with any person or
`persons to unlawfully do, or permit, or cause to be done any
`of the acts or things mentioned above in this section.
`62. Section 631(a) is not limited to phone lines, but also applies to “new
`technologies” such as computers, the Internet, and email. See Matera v. Google Inc.,
`2016 WL 8200619, at *21 (N.D. Cal. Aug. 12, 2016) (CIPA applies to “new
`technologies” and must be construed broadly to effectuate its remedial purpose of
`protecting privacy); Bradley v. Google, Inc., 2006 WL 3798134, at *5-6 (N.D. Cal.
`Dec. 22, 2006) (CIPA governs “electronic communications”); In re Facebook, Inc.
`Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020) (reversing dismissal of
`CIPA and common law privacy claims based on Facebook’s collection of consumers’
`Internet browsing history).
`63. FullStory’s software, including its Session Replay feature, is a “machine,
`instrument, contrivance, or … other manner” used to engage in the prohibited
`conduct at issue here.
`
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`15
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 17 of 21 Page ID #:121
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`64. At all relevant times, by using FullStory’s technology, Defendants
`intentionally tapped, electrically or otherwise, the lines of internet communication
`between Plaintiff and Class Members on the one hand, and Nike’s Website on the
`other hand.
`65. At all relevant times, by using FullStory’s technology, Defendants
`willfully and without the consent of all parties to the communication, or in any
`unauthorized manner, read or attempted to read or learn the contents or meaning of
`electronic communications of Plaintiff and putative class members, while the
`electronic communications were in transit or passing over any wire, line or cable or
`were being sent from or received at any place within California.
`66. As FullStory notes on its website, “When an end user session is recorded
`by the FullStory script, FullStory starts by recording event data locally in the
`browser. Every few seconds, this local event data is packaged up and sent to
`FullStory recording servers in the form of bundles.” Such local recording is plainly
`occurring in real-time, and is, at worst, “transitory electronic storage” that is “part of
`the overall transmission process,” which has been held to constitute communications
`“in transit.”
`67.
`Indeed, FullStory offers website operators the ability to “Go Live” with
`currently active website sessions (i.e., users still have the website open on their
`browser), which would not be possible if FullStory was not recording users in real
`time.
`
`68. Defendants aided, agreed with, and conspired with each other to
`implement FullStory’s technology and to accomplish the wrongful conduct at issue
`here. In addition, Nike employed FullStory to accomplish the wrongful conduct at
`issue here.
`69. Plaintiff and Class Members did not consent to any of Defendants’
`actions in implementing FullStory’s wiretaps on the Website. Nor have Plaintiff nor
`Class Members consented to Defendants’ intentional access, interception, reading,
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`16
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 18 of 21 Page ID #:122
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`learning, recording, and collection of Plaintiff and Class Members’ electronic
`communications.
`70. The violation of section 631(a) constitutes an invasion of privacy
`sufficient to confer Article III standing.
`71. Unless enjoined, Defendants will continue to commit the illegal acts
`alleged here. Plaintiff continues to be at risk because he frequently uses the internet
`for shopping, and he continues to desire to use the internet for that purpose.
`Defendant FullStory provides its software, including the Session Replay feature, to
`many other website operators who offer a wide array of services. For many websites
`that Plaintiff may or is likely to visit in the future, he has no practical way to know if
`his website communications will be monitored or recorded by FullStory.
`72. Plaintiff and Class Members seek all relief available under Cal. Penal
`Code § 637.2, including injunctive relief and statutory damages of $5,000 per
`violation.
`
`COUNT II
`Violation Of The California Invasion Of Privacy Act,
`Cal. Penal Code § 635
`73. Plaintiff repeats the allegations contained in the foregoing paragraphs as
`if fully set forth herein.
`74. Plaintiff brings this claim individually and on behalf of the members of
`the proposed Class against Defendants.
`75. California Penal Code § 635 provides, in pertinent part:
`
`Every person who manufactures, assembles, sells, offers for
`sale, advertises for sale, possesses, transports, imports, or
`furnishes to another any device which is primarily or
`exclusively designed or intended for eavesdropping upon the
`communication of another, or any device which is primarily
`or exclusively designed or intended for the unauthorized
`interception or reception of communications between
`cellular radio telephones or between a cellular radio
`telephone and a landline telephone in violation of Section
`FIRST AMENDED CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`CASE NO. 2:20-CV-09581-FMO-RAO
`
`17
`
`

`

`Case 2:20-cv-09581-FMO-RAO Document 24 Filed 12/22/20 Page 19 of 21 Page ID #:123
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`632.5, or communications between cordless telephones or
`between a cordless tele