Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 1 of 39
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`
`
`PATRICK CALHOUN, et al.,
`Plaintiffs,
`
`v.
`
`GOOGLE LLC,
`Defendant.
`
`Case No. 20-CV-05146-LHK
`
`ORDER GRANTING IN PART AND
`DENYING IN PART MOTION TO
`DISMISS WITH LEAVE TO AMEND
`Re: Dkt. No. 57
`
`
`
`
`
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`Plaintiffs Patrick Calhoun, Elaine Crespo, Hadiyah Jackson, and Claudia Kindler
`
`(collectively, “Plaintiffs”), individually and on behalf of all others similarly situated, sue
`
`Defendant Google LLC (“Google”). Before the Court is Google’s motion to dismiss Plaintiffs’
`
`complaint. ECF No. 57. Having considered the parties’ submissions and oral arguments, the
`
`relevant law, and the record in this case, the Court GRANTS IN PART AND DENIES IN PART
`
`Google’s motion to dismiss with leave to amend.
`I. BACKGROUND
`A. Factual Background
`1. Google’s Alleged Collection of Plaintiffs’ Data
`Plaintiffs are users of Google’s Chrome browser who allege that they “chose not to ‘Sync’
`1
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 2 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`their [Chrome] browsers with their Google accounts while browsing the web . . . from July 27,
`
`2016 to the present.” ECF No. 1 (“Compl.”) ¶ 1. Chrome’s Sync feature enables users to store
`
`their personal information by logging into Chrome with their Google account. Id. ¶ 39.1
`
`Plaintiffs allege that “Chrome sends . . . personal information to Google when a user
`
`exchanges communications with any website that includes Google surveillance source code . . .
`
`regardless of whether a user is logged-in to Google Sync or not.” Id. ¶ 134 (emphasis omitted).
`
`According to Plaintiffs, Google’s code “is found on websites accounting for more than half of all
`
`internet tracking” and “Chrome is . . . used on a majority [59%] of desktop computers in the
`
`United States, giving Google unprecedented power to surveil the lives of more than half of the
`
`online country in real time.” Id. ¶¶ 9, 194.
`
`Plaintiffs allege Google collects five different types of personal information: (1) “The
`
`user’s unique, persistent cookie identifiers”; (2) “The user’s browsing history in the form of the
`
`contents of the users’ GET requests and information relating to the substance, purport, or meaning
`
`of the website’s portion of the communication with the user”; (3) “In many cases, the contents of
`
`the users’ POST communications”; (4) “The user’s IP address and User-Agent information about
`
`their device”; and (5) The user’s X-Client Data Header. Id. ¶ 134.
`
`First, according to Plaintiffs, Google collects “[t]he user’s unique, persistent cookie
`
`identifiers.” Id. ¶ 134. “A cookie is a small text file that a web-server can place on a person’s web
`
`browser and computing device when that person’s web browser interacts with the website server.”
`
`Id. ¶ 55. According to Plaintiffs, “[c]ookies are designed to and, in fact, do operate as a means of
`
`identification for Internet users.” Id. ¶ 57. Plaintiffs allege that “Google uses several cookies to
`
`identify specific Internet users and their devices.” Id. ¶ 61. Plaintiffs further allege that “Google
`
`also engages in a controversial practice known as ‘cookie synching’ which further allows Google
`
`
`1 According to Google, “Chrome offers four modes: (1) Basic Browser; (2) Signed In; (3) Signed
`In with sync enabled; and (4) Incognito.” ECF No. 57 (“Mot.”) at 1 n.1. In the instant case,
`Plaintiffs allege that they used only the first two modes. Id. In a related case, Brown v. Google, the
`plaintiffs challenge Google’s data collection while they were in private browsing mode, which is
`called Incognito mode in Chrome. See Case No. 20-CV-03664-LHK, ECF No. 168, ¶ 11.
`2
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 3 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`to associate cookies with specific individuals.” Id. ¶ 62.
`
`Second, Plaintiffs allege that Google collects “[t]he user’s browsing history in the form of
`
`the contents of the users’ GET requests and information relating to the substance, purport, or
`
`meaning of the website’s portion of the communication with the user.” Id. ¶ 134. A GET request is
`
`one of “[t]he basic commands that Chrome uses to send the users’ side of a communication.” Id. ¶
`
`114. When a user types a website address or clicks a link to a website, “Chrome contacts the
`
`website . . . and sends a [GET request].” Id. ¶ 115. According to Plaintiffs, Chrome “[p]laces the
`
`contents of [a] GET . . . request in storage in the browser’s web-browsing history and short-term
`
`memory.” Id. ¶ 117. Chrome allegedly stores the contents of the communication “so that, if the
`
`user’s web-browser crashes unexpectedly, when the user re-starts their browser, the browser will
`
`be able to offer the user the ability to return to their last communications prior to the browser’s
`
`crash.” Id. ¶ 118.
`
`Third, Plaintiffs allege that Google collects “[i]n many cases, the contents of the users’
`
`POST communications.” Id. ¶ 134. Like a GET request, a POST request is one of “[t]he basic
`
`commands that Chrome uses to send the users’ side of a communication.” Id. ¶ 114. “If . . . [a]
`
`user were filling out a form on [a] website and clicks a button to submit the information in the
`
`form, Chrome . . . makes [a] connection with the website server [and] . . . sends a ‘POST’ request
`
`that includes the specific content that the user placed in the form.” Id. ¶ 116. According to
`
`Plaintiffs, Chrome “[p]laces the contents of [a] . . . POST request in storage in the browser’s web-
`
`browsing history and short-term memory.” Id. ¶ 117. Chrome allegedly stores the contents of the
`
`communication “so that, if the user’s web-browser crashes unexpectedly, when the user re-starts
`
`their browser, the browser will be able to offer the user the ability to return to their last
`
`communications prior to the browser’s crash.” Id. ¶ 118.
`
`Fourth, according to Plaintiffs, Google collects “[t]he user’s IP address and User-Agent
`
`information about their device.” Id. ¶ 134. “An IP address is a number that identifies a computer
`
`connected to the Internet.” Id. ¶ 47. “IP addresses of individual Internet users are used by Internet
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`3
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 4 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`service providers, websites, and tracking companies to facilitate and track Internet
`
`communications.” Id. ¶ 50. Plaintiffs allege that “Google tracks IP addresses associated with
`
`specific Internet users” and “associate[s] specific users with IP addresses.” Id. ¶¶ 51–52. Plaintiffs
`
`further allege that “[b]ecause Google collects the IP Address and user agent information together,
`
`Google can identify a user’s individual device even if more than one device shares the same IP
`
`address.” Id. ¶ 54.
`
`Finally, Plaintiffs allege that Google collects the user’s X-Client Data Header. Id. ¶ 134.
`
`The X-Client Data Header “is an identifier that when combined with IP address and user-agent,
`
`uniquely identifies every individual download version of the Chrome browser.” Id. ¶ 69. Plaintiffs
`
`allege that, as of March 6, 2018, the X-Client Data Header “is sent from Chrome to Google every
`
`time users exchange an Internet communication, including when users log-in to their specific
`
`Google accounts, use Google services such as Google search or Google maps, and when Chrome
`
`users are neither signed-in to their Google accounts nor using any Google service.” Id. ¶ 70.
`2. Google’s Representations to Plaintiffs
`According to Plaintiffs, “Google expressly promises Chrome users that they ‘don’t need to
`
`provide any personal information to use Chrome,’ and that ‘[t]he personal information that
`
`Chrome stores won’t be sent to Google unless you choose to store that data in your Google
`
`Account by turning on sync[.]’” Id. ¶ 2. Conversely, Google contends that it explicitly disclosed
`
`the alleged data collection. Mot. at 3–5. Four documents are of particular relevance regarding
`
`Google’s representations to users: (1) Google’s Terms of Service; (2) Google’s Privacy Policy; (3)
`
`Chrome’s Terms of Service; and (4) Chrome’s Privacy Notice. The Court discusses each
`
`document in turn.
`
`First, as of March 31, 2020, Google’s Terms of Service stated that the “Terms of Service
`
`help define Google’s relationship with you as you interact with our services.” Compl. Exh. 4.
`
`Google’s Terms of Service state that “[u]understanding these terms is important because, by using
`
`our services, you’re agreeing to these terms.” Id. Prior versions of Google’s Terms of Service
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`4
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 5 of 39
`
`
`
`made similar statements.
`
`From April 14, 2014 until March 31, 2020, Google’s Terms of Service invoked Google’s
`
`Privacy Policy as follows: “You can find more information about how Google uses and stores
`
`content in the privacy policy or additional terms for particular services.” Compl. Exh. 2, 3. As of
`
`March 31, 2020, Google’s Terms of Service explicitly excluded Google’s Privacy Policy:
`
`“Besides these terms, we also publish a Privacy Policy. Although it’s not part of these terms, we
`
`encourage you to read it to better understand how you can update, manage, export, and delete your
`
`information” Compl. Exh. 4.
`
`Google’s Terms of Service also invoke Google’s service-specific terms and policies: “Next
`
`to each service, we also list additional terms and policies that apply to that particular service. The
`
`Terms of Service, additional terms, and policies define our relationship and mutual expectations as
`
`you use these services.” Id.
`
`Finally, Google’s Terms of Service state that “California law will govern all disputes
`
`arising out of or relating to these terms, service-specific additional terms, or any related services,
`
`regardless of conflict of laws rules.” Compl. Exh. 4.
`
`Second, Google’s Privacy Policy states: “[A]s you use our services, we want you to be
`
`clear how we’re using information and the ways in which you can protect your privacy.” Compl.
`
`Exh. 7. Google’s Privacy Policy states:
`
`Our Privacy Policy explains:
`• What information we collect and why we collect it.
`• How we use that information.
`• The choices we offer, including how to access and update
`information.
`
`Id.
`
`Google’s Privacy Policy in effect from June 28, 2016 to August 29, 2016 made the
`
`following disclosures regarding Google’s collection of data from users:
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`5
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 6 of 39
`
`
`
`We collect information about the services that you use and how you
`use them, like when you . . . visit a website that uses our advertising
`services, or view and interact with our ads and content.
`
`This information includes: . . . device-specific information (such as
`your hardware model, operating system version, unique device
`identifiers, and mobile network
`information
`including phone
`number).
`
`When you use our services or view content provided by Google, we
`automatically collect and store certain information in server logs,
`[including] details of how you used our service, such as your search
`queries . . . Internet protocol address . . . device event information
`such as . . . the date and time of your request and referral URL [and]
`cookies that may uniquely identify your browser or your Google
`Account.
`
`Cookies and similar technologies.
`
`We and our partners use various technologies to collect and store
`information when you visit a Google service, and this may include
`using cookies or similar technologies to identify your browser or
`device. We also use these technologies to collect and store
`information when you interact with services we offer to our partners,
`such as advertising services or Google features that may appear on
`other sites. Our Google Analytics product helps businesses and site
`owners analyze the traffic to their websites and apps. When used in
`conjunction with our advertising services, such as those using the
`DoubleClick cookies, Google Analytics information is linked, by the
`Google Analytics customer or by Google, using Google technology,
`with information about visits to multiple sites.
`Id. (emphasis omitted). Subsequent versions of Google’s Privacy Policy made similar disclosures.
`
`
`
`Third, Chrome’s Terms of Service state the following: “By using Chrome or Chrome OS,
`
`you agree to the Google Terms of Service . . . and these Google Chrome and Chrome OS
`
`Additional Terms of Service.” Compl. Exh. 6.
`
`
`
`Finally, the Chrome Privacy Notice invites users to “[l]earn how to control the information
`
`that’s collected, stored, and shared when you use the Google Chrome browser on your computer
`
`or mobile device.” Compl. ¶ 37, Exhs. 17–33. The Chrome Privacy Notice states: “You don’t need
`
`to provide any personal information to use Chrome, but Chrome has different modes you can use
`
`to change or improve your browsing experience. Privacy practices are different depending on the
`
`mode you’re using.” Id. The Chrome Privacy Notice then states that “Basic browser mode . . .
`
`stores information locally on your system. This information might include:” “Browsing history
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`6
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 7 of 39
`
`
`
`information”; “Personal information and passwords”; and “Cookies or data from websites you
`
`visit.” Id. The Chrome Privacy Notice later states: “The personal information that Chrome stores
`
`won’t be sent to Google unless you choose to store that data in your Google account by turning on
`
`sync.” Compl. ¶ 38, Exhs. 28–33.2
`B. Procedural History
`On July 27, 2020, Plaintiffs filed the instant case against Google. Compl. Plaintiffs sought
`
`to represent a class of “all persons residing in the United States who used Google’s Chrome
`
`browser on or after July 27, 2016 without choosing to Sync with any Google account and whose
`
`personal information was collected by Google.” Id. ¶ 259.
`
`Plaintiffs brought 16 claims: (1) unauthorized interception of electronic communications
`
`under the Wiretap Act; (2) unauthorized electronic communication service (“ECS”) disclosure
`
`under the Wiretap Act, 18 U.S.C. § 2510; (3) unauthorized access to stored ECS communications
`
`under the Stored Communications Act (“SCA”), 18 U.S.C. § 2701; (4) unauthorized disclosures of
`
`stored communications under the SCA,18 U.S.C. § 2701; (5) violation of the California Invasion
`
`of Privacy Act (“CIPA”), Cal. Penal Code § 631; (6) invasion of privacy; (7) intrusion upon
`
`seclusion; (8) breach of contract; (9) breach of the implied covenant of good faith and fair dealing;
`
`(10) quasi-contract (restitution and unjust enrichment); (11) violation of the Computer Fraud and
`
`Abuse Act (“CFAA”), 18 U.S.C. § 1030(g); (12) violation of the California Computer Data
`
`Access and Fraud Act, Cal. Penal Code § 502; (13) statutory larceny, Cal. Penal Code §§ 484 and
`
`496; (14) violation of the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §
`
`17200, et seq.; (15) punitive damages under Cal. Civil Code § 3294; and (16) declaratory relief
`
`under 28 U.S.C. § 2201(a). Id. ¶¶ 266–426.
`
`
`2 The previous versions of Chrome’s Privacy Notice made very similar statements. See Compl. ¶
`38, Exhs. 17–24 (“The personal information that Chrome stores won’t be sent to Google unless
`you choose to store that data in your Google Account by signing into Chrome. Signing in enables
`Chrome’s synchronization feature.”); Compl. ¶ 38, Exhs. 25–27 (“The personal information that
`Chrome stores won’t be sent to Google unless you choose to store that data in your Google
`Account by turning on Chrome sync.”).
`
`7
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 8 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`On September 18, 2020, the Court directed the parties to select 10 claims to litigate. ECF
`
`No. 51. On September 25, 2020, the parties selected the following 10 claims: (1) unauthorized
`
`disclosure under the Wiretap Act; (2) unauthorized access under the SCA; (3) unauthorized
`
`disclosures of stored communications under the SCA; (4) violation of the CIPA; (5) intrusion
`
`upon seclusion; (6) breach of contract; (7) breach of the implied covenant of good faith and fair
`
`dealing; (8) violation of the CFAA; (9) statutory larceny; and (10) violation of the UCL. ECF No.
`
`54.
`
`On October 5, 2020, Google filed the instant motion to dismiss, ECF No. 57 (Mot.),
`
`and a request for judicial notice, ECF No. 58. On November 9, 2020, Plaintiffs filed an opposition
`
`to Google’s motion, ECF No. 67 (“Opp’n”), and their own request for judicial notice, ECF No. 66.
`
`On December 3, 2020, Google filed a reply in support of their motion to dismiss, ECF No. 81
`
`(“Reply”), and a response to Plaintiffs’ request for judicial notice, ECF No. 82.
`
`The Court may take judicial notice of matters that are either “generally known within the
`
`trial court’s territorial jurisdiction” or “can be accurately and readily determined from sources
`
`whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). However, to the extent
`
`any facts in documents subject to judicial notice are subject to reasonable dispute, the Court will
`
`not take judicial notice of those facts. See Lee v. City of Los Angeles, 250 F.3d 668, 689 (9th Cir.
`
`2001), overruled on other grounds by Galbraith v. County of Santa Clara, 307 F.3d 1119 (9th Cir.
`
`2002).
`
`Plaintiffs request that the Court take judicial notice of an October 6, 2020 House Report;
`
`an October 13, 2011 Federal Trade Commission (“FTC”) Order; and an August 8, 2012 FTC
`
`Complaint. ECF No. 66. The Court will take judicial notice of these documents as public records,
`
`which are proper subjects of judicial notice. See, e.g., United States v. Black, 482 F.3d 1035, 1041
`
`(9th Cir. 2007).
`
`Plaintiffs request that the Court take judicial notice of three publicly available Google
`
`webpages. ECF No. 66. Google requests that the Court take judicial notice of four versions of
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`8
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 9 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Google’s Privacy Policy. ECF No. 58. These documents appear on publicly available websites and
`
`are thus proper subjects for judicial notice. See, e.g., In re Google Assistant Privacy Litig., 457 F.
`
`Supp. 3d 797, 813–14 (N.D. Cal. 2020) (taking judicial notice of Google’s Terms of Service,
`
`Privacy Policy, and a Google blog post); Matera v. Google, Inc., 2016 WL 5339806, at *7 (N.D.
`
`Cal. Sept. 23, 2016) (taking judicial notice of Google’s Terms of Service, “various versions of
`
`Google’s Privacy Policy,” and a Google webpage entitled “Updates: Privacy Policy”).
`
`Google does not contest that the documents of which Plaintiffs request judicial notice are
`
`proper subjects of judicial notice. ECF No. 82. However, Google contends that Plaintiffs seek
`
`judicial notice of these documents for improper purposes. Id. Specifically, Google argues that the
`
`Court cannot take judicial notice of the October 6, 2020 House Report for the purpose of
`
`establishing that House investigators had the same understanding of Google’s Privacy Policy as
`
`Plaintiffs did. Id. at 1. Google further contends that the Court cannot take judicial notice of the
`
`FTC documents to show that Google is acting in bad faith. Id. at 2. Finally, Google argues that the
`
`Court cannot take judicial notice of the three publicly available webpages to show that Google
`
`knows that Google’s Privacy Policy is not sufficient for blanket consent. Id. at 4.
`
`The Court agrees with Google that the Court cannot take judicial notice of any facts in
`
`these documents that are subject to reasonable dispute. See Lee, 250 F.3d at 689. Accordingly, to
`
`the extent any facts in these documents are subject to reasonable dispute, the Court will not take
`
`judicial notice of those facts. Id. Thus, the Court GRANTS Google’s request for judicial notice
`
`and GRANTS Plaintiffs’ request for judicial notice.
`
`Finally, Plaintiffs move to file supplementary material, ECF No. 127, in response to
`
`arguments Google made about the Court’s website at the February 25, 2021 motion to dismiss
`
`hearing in a related case, Brown v. Google (“Brown”). See Case No. 20-CV-03664-LHK, Tr. of
`
`Feb. 25, 2021 Hearing at 47:13–16, ECF No. 104. Google never raised these arguments in their
`
`briefs on the motions to dismiss in either case or at the February 18, 2021 hearing on the instant
`
`motion to dismiss. The Court did not consider Google’s untimely arguments in the Court’s order
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`9
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 10 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`denying the motion to dismiss in the Brown case, ECF No. 113, and will not do so here. See In re
`
`Apple Inc. Securities Litigation, 2011 WL 1877988, *5 n. 6 (N.D. Cal. May 17, 2011) (“The Court
`
`is not inclined to consider this argument given that it was not briefed but rather was raised for the
`
`first time at the end of the hearing”); White v. FedEx Corp., 2006 WL 618591, *2 (N.D. Cal. Mar.
`
`13, 2006) (“The Court will not consider any arguments or evidence raised for the first time at the
`
`hearing”). Accordingly, the Court DENIES Plaintiffs’ motion to file supplementary material, ECF
`
`No. 127.
`II. LEGAL STANDARD
`A. Dismissal Pursuant to Federal Rule of Civil Procedure 12(b)(6)
`Rule 8(a) of the Federal Rules of Civil Procedure requires a complaint to include “a short
`
`and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a).
`
`A complaint that fails to meet this standard may be dismissed pursuant to Federal Rule of Civil
`
`Procedure 12(b)(6). Rule 8(a) requires a plaintiff to plead “enough facts to state a claim to relief
`
`that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim
`
`has facial plausibility when the plaintiff pleads factual content that allows the court to draw the
`
`reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556
`
`U.S. 662, 678 (2009). “The plausibility standard is not akin to a probability requirement, but it
`
`asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (internal
`
`quotation marks omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s]
`
`factual allegations in the complaint as true and construe[s] the pleadings in the light most
`
`favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025,
`
`1031 (9th Cir. 2008).
`
`The Court, however, need not accept as true allegations contradicted by judicially
`
`noticeable facts, see Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and it “may look
`
`beyond the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6)
`
`motion into a motion for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir.
`
`1995). Nor must the Court “assume the truth of legal conclusions merely because they are cast in
`10
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 11 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per
`
`curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere
`
`“conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to
`
`dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004).
`B. Leave to Amend
`If the Court determines that a complaint should be dismissed, it must then decide whether
`
`to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend
`
`“shall be freely given when justice so requires,” bearing in mind “the underlying purpose of Rule
`
`15 to facilitate decisions on the merits, rather than on the pleadings or technicalities.” Lopez v.
`
`Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (alterations and internal quotation marks
`
`omitted). When dismissing a complaint for failure to state a claim, “'a district court should grant
`
`leave to amend even if no request to amend the pleading was made, unless it determines that the
`
`pleading could not possibly be cured by the allegation of other facts.” Id. at 1130 (internal
`
`quotation marks omitted). Accordingly, leave to amend generally shall be denied only if allowing
`
`amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the
`
`moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532
`
`(9th Cir. 2008).
`III. DISCUSSION
`
`In its motion to dismiss, Google first contends that Plaintiffs’ claims should be dismissed
`
`because Plaintiffs and the websites consented to Google’s receipt of the data. Mot. at 8–11.
`
`Google later argues that Plaintiffs’ claims should be dismissed because of the statutes of
`
`limitations. Mot. at 25. Google also argues that Plaintiffs have failed to state nine of the ten
`
`selected claims for additional reasons. Id. at 11–25. The Court addresses in turn: (1) consent; (2)
`
`the statutes of limitations; and (3) Google’s other arguments for dismissal.
`A. Consent
`Google contends that (1) all claims should be dismissed because Plaintiffs consented to
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`11
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 12 of 39
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Google’s receipt of the data, and (2) Plaintiffs’ unauthorized disclosure claims under the Wiretap
`
`Act and the SCA should be dismissed because the websites consented to Google’s receipt of the
`
`data. Id. at 8–11. The Court addresses each argument in turn.
`1. Google has not shown that Plaintiffs consented.
`Consent is a defense to Plaintiffs’ claims. See 18 U.S.C. § 2511(3)(b)(ii) (Wiretap Act)
`
`(stating that a communication may be divulged “with the lawful consent of the originator”); 18
`
`U.S.C. § 2702(b)(3) (SCA unauthorized disclosure) (stating that a communication may be
`
`divulged with the “lawful consent of the originator”); id. § 2701(c)(2) (SCA unauthorized access)
`
`(providing an exception from liability for conduct authorized by the user); Smith v. Facebook, Inc.,
`
`262 F. Supp. 3d 943, 955–56 (N.D. Cal. 2017), aff’d, 745 F. App’x 8 (9th Cir. 2018) (“Plaintiffs’
`
`consent . . . bars their common-law tort claims [for intrusion upon seclusion] . . . .”); 18 U.S.C. §
`
`1030(a)(5)(A) (CFAA) (prohibiting “the transmission of a program, information, code, or
`
`command . . . without authorization”); People v. Brock, 143 Cal. App. 4th 1266, 1274 (2006)
`
`(“Theft by larceny . . . is not committed when the property is taken with the owner’s consent.”);
`
`Cal. Pen. Code §§ 631(a), 632(a) (CIPA) (prohibiting wiretapping and eavesdropping “without the
`
`consent of all parties to the communication”).3 Accordingly, Google contends that Plaintiffs
`
`consented to Google’s alleged data collection. Mot. at 9.
`
`“[A]s ‘the party seeking the benefit of the exception,’ it is Google’s burden to prove
`
`consent.” Matera v. Google Inc., 2016 WL 5339806, at *17. Consent “can be explicit or implied,
`
`but any consent must be actual.” In re Google, Inc., 2013 WL 5423918, at *12 (N.D. Cal. Sept.
`
`26, 2013). In order for consent to be actual, the disclosures must “explicitly notify” users of the
`
`practice at issue. Id. at *13; see also Campbell v. Facebook, Inc., 77 F. Supp. 3d 836, 847–48
`
`(N.D. Cal. 2014) (explaining that, for a finding of consent, the disclosures must have given users
`
`
`3 Consent is also a defense to Plaintiffs’ breach of contract and good faith and fair dealing claims
`because if Plaintiffs consented to the alleged data collection, Google would not have breached its
`contract with Plaintiffs by engaging in the alleged data collection. Furthermore, consent is a
`defense to Plaintiffs’ UCL claim, which is predicated on Google’s representations and Plaintiffs’
`other claims. See Section III(C)(8), infra.
`
`12
`
`Case No. 20-CV-05146-LHK
`ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS WITH LEAVE TO AMEND
`
`Northern District of California
`United States District Court
`
`

`

`Case 4:20-cv-05146-YGR Document 142 Filed 03/17/21 Page 13 of 39
`
`
`
`notice of the “specific practice” at issue). The disclosures must have only one plausible
`
`interpretation for a finding of consent. In re Facebook, Inc., Consumer Privacy User Profile Litig.,
`
`402 F. Supp. 3d 767, 794 (N.D. Cal. 2019) [hereinafter “Facebook Consumer Profile”]. “[I]f a
`
`reasonable . . . user could have plausibly interpreted the contract language as not disclosing that
`
`[the defendant] would engage in particular conduct, then [the defendant] cannot obtain dismissal
`
`of a claim about that conduct (at least not based on the issue of consent).” Id. at 789–90.
`
`In the instant motion, Google contends that users expressly consented to Google’s alleged
`
`data collection. Mot. at 9. In In re Google, Inc., this Court rejected a similar argument made by
`
`Google. 2013 WL 5423918, at *12–*14. In that case, the plaintiffs alleged that Google had
`
`intercepted their email co