Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 1 of 41
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`
`
`CHASOM BROWN, et al.,
`Plaintiffs,
`
`v.
`
`GOOGLE LLC,
`Defendant.
`
`Case No. 20-CV-03664-LHK
`
`ORDER DENYING MOTION TO
`DISMISS
`Re: Dkt. No. 82
`
`
`
`
`
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`Plaintiffs Chasom Brown, Maria Nguyen, William Byatt, Jeremy Davis, and Christopher
`
`Castillo (collectively, “Plaintiffs”), individually and on behalf of all others similarly situated, sue
`
`Defendant Google LLC (“Google”). Before the Court is Google’s motion to dismiss Plaintiffs’
`
`first amended complaint. ECF No. 82. Having considered the parties’ submissions and oral
`
`arguments, the relevant law, and the record in this case, the Court DENIES Google’s motion to
`
`dismiss.
`I. BACKGROUND
`A. Factual Background
`Plaintiffs are Google account holders who used their browser in “private browsing mode.”
`
`ECF No. 68 (“FAC”) ¶ 11. Plaintiffs challenge Google’s alleged collection of their data while they
`1
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 2 of 41
`
`
`
`were in private browsing mode. Id. ¶ 5.
`1. Plaintiffs’ Use of Private Browsing Mode
`Plaintiffs are Google account holders who used their browser in “private browsing mode.”
`
`Id. ¶ 11. In Google’s Chrome browser (“Chrome”), private browsing mode is referred to as
`
`“Incognito mode.” All Plaintiffs used Google’s Chrome browser in Incognito mode. Id. ¶¶ 168,
`
`173, 178, 183, 188 (stating that Plaintiffs used Chrome in Incognito mode). However, one plaintiff
`
`also used a different browser, Apple’s Safari browser, in private browsing mode. Id. ¶ 173 (stating
`
`that Plaintiff Nguyen used Safari in private browsing mode). Furthermore, Plaintiffs seek to
`
`represent a class of users of private browsing mode without regard to the specific browser used. Id.
`
`¶ 192.
`
`Plaintiffs allege that “users of the Internet enable ‘private browsing mode’ for the purpose
`
`of preventing others . . . from finding out what the users are viewing on the Internet.” Id. ¶ 162.
`
`For example, users often enable private browsing mode in order to visit especially sensitive
`
`websites. Id. Accordingly, “users’ Internet activity, while in ‘private browsing mode,’ may reveal:
`
`a user’s dating history, a user’s sexual interests and/or orientation, a user’s political or religious
`
`views, a user’s travel plans, a user’s private plans for the future (e.g., purchasing of an engagement
`
`ring).” Id.
`2. Google’s Alleged Collection of Plaintiffs’ Data
`Plaintiffs allege that Google collects data from them while they are in private browsing
`
`mode “through means that include Google Analytics, Google ‘fingerprinting’ techniques,
`
`concurrent Google applications and processes on a consumer’s device, and Google’s Ad
`
`Manager.” Id. ¶ 8. According to Plaintiffs, “[m]ore than 70% of all online publishers (websites)
`
`use one or more of these Google services.”
`
`Specifically, Plaintiffs allege that, whenever a user, including a user in private browsing
`
`mode, visits a website that is running Google Analytics or Google Ad Manager, “Google’s
`
`software scripts on the website surreptitiously direct the user’s browser to send a secret, separate
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`2
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 3 of 41
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`message to Google’s servers in California.” Id. ¶ 63. This message includes six elements, each of
`
`which is discussed below.
`
`First, Plaintiffs allege that Google collects duplicate GET requests. Whenever a user visits
`
`a webpage, his or her browser sends a message to the webpage’s server, called a GET request. Id.
`
`The GET request “tells the website what information is being requested and then instructs the
`
`website to send the information to the user.” Id. Accordingly, when Google obtains a duplicate
`
`GET request, the duplicate GET request “enables Google to learn exactly what content the user’s
`
`browsing software was asking the website to display.” Id. The duplicate GET request “also
`
`transmits a . . . header containing the URL information of what the user has been viewing and
`
`requesting from websites online.” Id.1
`
`Second, Plaintiffs allege that Google collects the IP address of the user’s connection to the
`
`Internet, which is unique to the user’s device. Id. When a device is connected to the Internet, the
`
`Internet Service Provider (ISP) that is providing the internet connection will assign the device a
`
`unique IP address. Id. at 18 n.16. Although IP addresses can change over time, the ISP often
`
`continues to assign the same IP address to the same device. Id.
`
`Third, Plaintiffs allege that Google collects information identifying the browser software
`
`that the user is using, including “fingerprint” data. Id. Because every unique device and installed
`
`application has small differences, images, digital pixels, and fonts display slightly differently for
`
`every device and application. Id. ¶ 100. Plaintiffs allege that, “[b]y forcing a consumer to display
`
`one of its images, pixels, or fonts, online companies such as Google are able to ‘fingerprint’ their
`
`users.” Id.
`
`Fourth, Plaintiffs allege that Google collects user IDs issued by the website to the user. Id.
`
`
`1 Other courts have similarly described the process by which duplicate GET requests are sent to
`servers. See In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 607 (9th Cir. 2020)
`(describing process by which Facebook’s embedded code caused a user’s browser to transmit a
`duplicate GET request to Facebook) [hereinafter “Facebook Tracking”]; In re Google Cookie
`Placement Consumer Privacy Litigation, 806 F.3d 125, 130 (3d. Cir. 2015) (describing process by
`which Google received duplicate GET requests) [hereinafter “Google Cookie”].
`3
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 4 of 41
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`¶ 63. According to Plaintiffs, “Google offers an upgraded feature called ‘Google Analytics User-
`
`ID,’ which allows Google to map and match the user . . . to a specific unique identifier that Google
`
`can track across the web.” Id. ¶ 69. Plaintiffs allege that “[b]ecause of Google’s omnipresence on
`
`the web, the use of User-IDs can be so powerful that the IDs ‘identify related actions and devices
`
`and connect these seemingly independent data points.’” Id.
`
`Fifth, Plaintiffs allege that Google collects the geolocation of the user. Id. ¶ 63. According
`
`to Plaintiffs, Google collects “geolocation data from (1) the Android operating system running on
`
`users’ phones or tablets and (b) Google applications running on phones (e.g. Chrome and Maps),
`
`Google Assistant, Google Home, and other Google applications and services. Id. ¶ 105.
`
`Finally, Plaintiffs allege that Google collects information contained in Google cookies,
`
`which were saved by the user’s browser. Id. ¶ 63.2 According to Plaintiffs, “Google Analytics
`
`contains a script that causes the user’s . . . browser to transmit, to Google, information from each
`
`of the Google Cookies already existing on the browser’s cache.” Id. ¶ 70. These cookies “typically
`
`show, at a minimum, the prior websites the user has viewed.” Id. Thus, Google can obtain a user’s
`
`browsing history from the current browsing session.
`
` In addition, Plaintiffs allege that, for users using Chrome without Incognito Mode,
`
`Chrome constantly transmits “a unique digital string of characters called Google’s ‘X-Client-Data
`
`Header,’ such that Google uniquely identifies the device and user thereafter.” Id. ¶ 95. However,
`
`Plaintiffs allege that the X-Client Data Header is not present when a Chrome user has enabled
`
`Incognito Mode. Id. ¶ 96. Accordingly, Plaintiffs allege that Google is able to tell when a Chrome
`
`user has enabled Incognito Mode. Id. ¶ 96.
`3. Google’s Representations to Plaintiffs
`Plaintiffs allege that they “reasonably believed that their data would not be collected by
`
`
`2 Cookies are “small text files stored on the user’s device.” Facebook Tracking, 956 F.3d at 596.
`Cookies allow third-party companies like Google “to keep track of and monitor an individual
`user’s web activity over every website on which these companies inject ads.” Google Cookie, 806
`F.3d at 131.
`
`4
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 5 of 41
`
`
`
`Google and that Google would not intercept their communications when they were in ‘private
`
`browsing mode’” because of Google’s representations regarding private browsing mode. Id. ¶ 3.
`
`Conversely, Google contends that it disclosed the alleged data collection. ECF No. 82 (“Mot.”) at
`
`5–6. Five Google documents are of particular relevance regarding Google’s representations to
`
`users:3 (1) Google’s Privacy Policy; (2) Chrome’s Privacy Notice; (3) a Google webpage entitled
`
`“Search & browse privately”; (4) a Google webpage entitled “How private browsing works in
`
`Chrome”; and (5) the Incognito Splash Screen. The Court discusses each document in turn.
`
`First, Google’s Privacy Policy states: “As you use our services, we want you to be clear
`
`how we’re using information and the ways in which you can protect your privacy.” Schapiro Decl.
`
`Exh. 1. Google’s Privacy Policy states:
`
`Our Privacy Policy explains:
`• What information we collect and why we collect it.
`• How we use that information.
`• The choices we offer, including how to access and update
`information.
`
`Id.
`
`Google’s Privacy Policy in effect from March 25, 2016 to June 28, 2016 made the
`
`following disclosures regarding Google’s collection of data from users:
`
`We collect information about the services that you use and how you
`use them, like when you . . . visit a website that uses our advertising
`services, or view and interact with our ads and content.
`
`This information includes: . . . device-specific information (such as
`your hardware model, operating system version, unique device
`identifiers, and mobile network
`information
`including phone
`number).
`
`
`3 At the hearing on Google’s motion to dismiss, the Court asked the parties to identify the key
`documents for this motion. Tr. of Feb. 25, 2021 Hearing at 12:23–13:03, ECF No. 104. The parties
`directed the Court’s attention to eight documents, five of which are relevant to the representations
`Google made to users regarding private browsing and data collection. Id. at 15:10–14.
`Accordingly, the Court focuses on these documents.
`5
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 6 of 41
`
`
`
`When you use our services or view content provided by Google, we
`automatically collect and store certain information in server logs,
`[including] details of how you used our service, such as your search
`queries . . . Internet protocol address . . . device event information
`such as . . . the date and time of your request and referral URL [and]
`cookies that may uniquely identify your browser or your Google
`Account.
`Id. Subsequent versions of Google’s Privacy Policy made similar disclosures.
`
`Starting on May 25, 2018, Google’s Privacy Policy made statements regarding Chrome’s
`
`Incognito Mode:
`
`You can use our services in a variety of ways to manage your privacy.
`For example, you can sign up for a Google Account if you want to
`create and manage content like email or photos, or see more relevant
`search results. . . . You can also choose to browse the web privately
`using Chrome in Incognito mode. And across our services, you can
`adjust your privacy settings to control what we collect and how your
`information is used.
`Schapiro Decl. Exh. 8. Subsequent versions of Google’s Privacy Policy made similar statements.
`
`
`
`Second, Google’s Chrome Privacy Notice dated June 21, 2016 also made statements
`
`regarding Chrome’s Incognito Mode:
`
`You can limit the information Chrome stores on your system by using
`incognito mode or guest mode. In these modes, Chrome won’t store
`certain information, such as:
`• Basic browsing history information like URLs, cached paged
`text, or IP addresses of pages linked from the websites you
`visit.
`• Snapshots of pages that you visit . . . .
`How Chrome handles your incognito or guest information
`
`Cookies. Chrome won’t share existing cookies with sites you visit in
`incognito or guest mode. Sites may deposit new cookies on your
`system while you are in these modes, but they’ll only be stored and
`transmitted until you close the incognito or guest window.
`Schapiro Decl. Exh. 17.
`
`
`
`Third, Google’s webpage entitled “Search & browse privately” makes the following
`
`statements regarding private browsing:
`
`You’re in control of what information you share with Google when
`you search. To browse the web privately, you can use private
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`6
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 7 of 41
`
`
`
`
`
`browsing, sign out of your account, change your custom results
`settings, or delete past activity.
`
`If you want to search the web without saving your search activity to
`your account, you can use private browsing mode in a browser (like
`Chrome or Safari).
`
`
`
`How private browsing works
`
`Private browsing works differently depending on which browser you
`use. Browsing in private usually means:
`• The searches you do or sites you visit won’t be saved to your
`device or browsing history.
`• Files you download or bookmarks you create might be kept
`on your device.
`• Cookies are deleted after you close your private browsing
`window or tab.
`• You might see search results and suggestions based on your
`location or other searches you’ve done during your current
`browsing session.
`
`Schapiro Decl. Exh. 18.
`
`Fourth, Google’s webpage entitled “How private browsing works in Chrome” makes the
`
`following statements regarding private browsing:
`
`When you browse privately, other people who use the device won’t
`see your history . . . Cookies and site data are remembered while
`you’re browsing, but deleted when you exit Incognito mode.
`
`Your activity might still be visible.
`
`Incognito mode stops Chrome from saving your browsing activity to
`your local history. Your activity . . . might still be visible to:
`• Websites you visit, including the ads and resources used on
`those sites
`• Websites you sign in to
`• Your employer, school, or whoever runs the network you’re
`using
`• Your internet service provider
`• Search engines
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`7
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 8 of 41
`
`
`
`o Search engines may show search suggestions based on
`your location or activity in your current Incognito
`browsing session.
`
`Some of your info might still be visible.
`
`A web service, website, search engine, or provider may be able to see:
`• Your IP address, which can be used to identify your general
`location
``
`• Your activity when you use a web service . . . .
`Schapiro Decl. Exh. 19.
`
`Fifth, when a user enables Incognito Mode in the Chrome Browser, the following “Splash
`
`Screen” is displayed to the user with similar statements regarding private browsing mode:
`
`FAC ¶ 52.
`
`Finally, Plaintiffs’ complaint alleges that Google and its officials made additional
`
`statements regarding private browsing. For instance, Plaintiffs allege that, on September 27, 2016,
`
`Google’s Director of Product Management Unni Narayana published an article in which he
`
`
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`8
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 9 of 41
`
`
`
`explained that Google was giving users “more control with incognito mode.” FAC ¶ 146. The
`
`article stated the following: “Your searches are your business . . . When you have incognito mode
`
`turned on in your settings, your search and browsing history will not be saved.” Id. ¶¶ 42, 146.
`
`Moreover, Plaintiffs allege that, on May 7, 2019, the New York Times published an opinion
`
`article written by Google’s CEO, Sudar Pichai, who explained that Google focuses on “features
`
`that make privacy a reality.” Id. ¶ 146. The article stated: “For example, we recently brought
`
`Incognito mode, the popular feature in Chrome that lets you browse the web without linking any
`
`activity to you, to YouTube.” Id.
`B. Procedural History
`On June 2, 2020, Plaintiffs filed the instant case against Alphabet, Inc. and Google LLC.
`
`ECF No. 1. Plaintiffs bring five claims: (1) unauthorized interception under the Wiretap Act, 18
`
`U.S.C. § 2510 et seq.; (2) violation of the California Invasion of Privacy Act (“CIPA”), Cal. Penal
`
`Code §§ 631 and 632; (3) violation of the California Computer Data Access and Fraud Act
`
`(“CDAFA”), Cal. Penal Code § 502; (4) invasion of privacy; and (5) intrusion upon seclusion.
`
`FAC ¶¶ 202–266.
`
`Plaintiffs seek to represent two classes: (1) “All Android device owners who accessed a
`
`website containing Google Analytics or Ad Manager using such a device and who were (a) in
`
`“private browsing mode” on that device’s browser and (b) were not logged into their Google
`
`account on that device’s browser, but whose communications, including identifying information
`
`and online browsing history, Google nevertheless intercepted, received, or collected from June 1,
`
`2016 through the present” and (2) “All individuals with a Google account who accessed a website
`
`containing Google Analytics or Ad Manager using any non-Android device and who were (a) in
`
`“private browsing mode” in that device’s browser, and (b) were not logged into their Google
`
`account on that device’s browser, but whose communications, including identifying information
`
`and online browsing history, Google nevertheless intercepted, received, or collected from June 1,
`
`2016 through the present.” Id. ¶ 192.
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`9
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 10 of 41
`
`
`
`On August 20, 2020, Plaintiffs and Alphabet stipulated to voluntarily dismiss Alphabet
`
`from the case without prejudice. ECF No. 51. On August 24, 2020, the Court granted the
`
`stipulation and voluntarily dismissed Alphabet, leaving Google as the only defendant. ECF No.
`
`57.
`
`On August 20, 2020, Google filed a motion to dismiss the complaint. ECF No. 53. On
`
`September 21, 2020, Plaintiffs filed a first amended complaint in lieu of opposing the motion to
`
`dismiss. ECF No. 68. On October 6, 2020, the Court denied as moot the motion to dismiss. ECF
`
`No. 74.
`
`On October 21, 2020, Google filed the instant motion to dismiss the first amended
`
`complaint, ECF No. 82 (“Mot.”) and a request for judicial notice, ECF No. 84. On November 18,
`
`2020, Plaintiffs filed an opposition to Google’s motion, ECF No. 87 (“Opp’n”), a response to
`
`Google’s request for judicial notice, ECF No. 88, and their own request for judicial notice, ECF
`
`No. 89. On December 7, 2020, Google filed a reply in support of its motion to dismiss, ECF No.
`
`92 (“Reply”), and a response to Plaintiffs’ response regarding Google’s request for judicial notice,
`
`ECF No. 93.
`
`The Court may take judicial notice of matters that are either “generally known within the
`
`trial court’s territorial jurisdiction” or “can be accurately and readily determined from sources
`
`whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). However, to the extent
`
`any facts in documents subject to judicial notice are subject to reasonable dispute, the Court will
`
`not take judicial notice of those facts. See Lee v. City of Los Angeles, 250 F.3d 668, 689 (9th Cir.
`
`2001), overruled on other grounds by Galbraith v. County of Santa Clara, 307 F.3d 1119 (9th Cir.
`
`2002).
`
`Google requests that the Court take judicial notice of twenty-seven documents, which
`
`include Google’s Terms of Service, fifteen versions of Google’s Privacy Policy, two versions of
`
`Google’s Chrome Privacy Notice, and nine publicly available Google webpages. ECF No. 84.
`
`Plaintiffs request that the Court take judicial notice of Google’s Privacy Policy in effect between
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`10
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 11 of 41
`
`
`
`March 31, 2020 and July 1, 2020, which is one of the fifteen versions of Google’s Privacy Policy
`
`of which Google requests the Court take judicial notice. ECF No. 89. These documents appear on
`
`publicly available websites and are thus proper subjects for judicial notice. See, e.g., In re Google
`
`Assistant Privacy Litig., 457 F. Supp. 3d 797, 813–14 (N.D. Cal. 2020) (taking judicial notice of
`
`Google’s Terms of Service, Privacy Policy, and a Google blog post); Matera v. Google, Inc., 2016
`
`WL 5339806, at *7 (N.D. Cal. Sept. 23, 2016) (taking judicial notice of Google’s Terms of
`
`Service, “various versions of Google’s Privacy Policy,” and a Google webpage entitled “Updates:
`
`Privacy Policy”).
`
`Plaintiffs contend that, as to six of the webpages presented by Google (Exhibits 19, 20, 22,
`
`23, 24, and 25 to the Schapiro Declaration), Google does not identify the dates on which they
`
`became publicly available, so the Court should take judicial notice of these webpages only as to
`
`their existence on the date the webpage was last accessed. ECF No. 88 at 1. However, Google
`
`demonstrates using the Internet Archive’s “Wayback Machine” that Exhibits 19 and 20 have been
`
`publicly available since August 18, 2018, and substantively identical versions of Exhibits 22 to 25
`
`have been publicly available since March 25, 2015 (Exhibit 22); June 13, 2014 (Exhibit 23);
`
`November 12, 2012 (Exhibit 24); and January 28, 2015 (Exhibit 25). ECF No. 93 at 3–4. “Courts
`
`have taken judicial notice of the contents of web pages available through the Wayback Machine as
`
`facts that can be accurately and readily determined from sources whose accuracy cannot
`
`reasonably be questioned.” See, e.g., Erickson v. Nebraska Mach. Co., 2015 WL 4089849, at *1 n.
`
`1 (N.D. Cal. July 6, 2015) (taking judicial notice of websites where “Plaintiffs provided copies of
`
`current versions of these websites . . . but the Internet Archive’s Wayback Machine shows that the
`
`websites were substantively identical during the relevant timeframe”). Accordingly, the Court
`
`takes judicial notices of these webpages as of these dates. Thus, the Court GRANTS Google’s
`
`request for judicial notice and GRANTS Plaintiffs’ request for judicial notice.
`
`Finally, at the hearing on the instant motion, Google raised for the first time arguments
`
`regarding the Court’s website. See Tr. of Feb. 25, 2021 Hearing at 47:13–16, ECF No. 104. In its
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`11
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 12 of 41
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`decision on the instant motion, the Court will not consider Google’s untimely arguments. See In re
`
`Apple Inc. Securities Litigation, 2011 WL 1877988, *5 n. 6 (N.D. Cal. May 17, 2011) (“The Court
`
`is not inclined to consider this argument given that it was not briefed but rather was raised for the
`
`first time at the end of the hearing”); White v. FedEx Corp., 2006 WL 618591, *2 (N.D. Cal. Mar.
`
`13, 2006) (“The Court will not consider any arguments or evidence raised for the first time at the
`
`hearing”). Accordingly, the Court DENIES Google’s motion to file an additional reply regarding
`
`the Court’s website, ECF No. 112.
`II. LEGAL STANDARD
`A. Dismissal Pursuant to Federal Rule of Civil Procedure 12(b)(6)
`Rule 8(a) of the Federal Rules of Civil Procedure requires a complaint to include “a short
`
`and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a).
`
`A complaint that fails to meet this standard may be dismissed pursuant to Federal Rule of Civil
`
`Procedure 12(b)(6). Rule 8(a) requires a plaintiff to plead “enough facts to state a claim to relief
`
`that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim
`
`has facial plausibility when the plaintiff pleads factual content that allows the court to draw the
`
`reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556
`
`U.S. 662, 678 (2009). “The plausibility standard is not akin to a probability requirement, but it
`
`asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (internal
`
`quotation marks omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s]
`
`factual allegations in the complaint as true and construe[s] the pleadings in the light most
`
`favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025,
`
`1031 (9th Cir. 2008).
`
`The Court, however, need not accept as true allegations contradicted by judicially
`
`noticeable facts, see Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and it “may look
`
`beyond the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6)
`
`motion into a motion for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir.
`
`1995). Nor must the Court “assume the truth of legal conclusions merely because they are cast in
`12
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 13 of 41
`
`
`
`the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per
`
`curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere
`
`“conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to
`
`dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004).
`B. Leave to Amend
`If the Court determines that a complaint should be dismissed, it must then decide whether
`
`to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend
`
`“shall be freely given when justice so requires,” bearing in mind “the underlying purpose of Rule
`
`15 to facilitate decisions on the merits, rather than on the pleadings or technicalities.” Lopez v.
`
`Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (alterations and internal quotation marks
`
`omitted). When dismissing a complaint for failure to state a claim, “'a district court should grant
`
`leave to amend even if no request to amend the pleading was made, unless it determines that the
`
`pleading could not possibly be cured by the allegation of other facts.” Id. at 1130 (internal
`
`quotation marks omitted). Accordingly, leave to amend generally shall be denied only if allowing
`
`amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the
`
`moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532
`
`(9th Cir. 2008).
`III. DISCUSSION
`In the instant motion, Google first contends that Plaintiffs’ claims should be dismissed
`
`because Plaintiffs and the websites consented to Google’s receipt of the data. Mot. at 9–13.
`
`Google later argues that Plaintiffs’ claims should be dismissed under the statutes of limitations. Id.
`
`at 23–25. Google also argues that Plaintiffs have failed to state their claims for additional reasons.
`
`Id. at 13–23. The Court addresses in turn: (1) consent; (2) the statutes of limitations; and (3)
`
`Google’s other arguments for dismissal.
`A. Consent
`Google contends that (1) all claims should be dismissed because Plaintiffs consented to
`
`Case No. 20-CV-03664-LHK
`ORDER DENYING MOTION TO DISMISS
`
`13
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:20-cv-03664-LHK Document 113 Filed 03/12/21 Page 14 of 41
`
`
`
`Google’s receipt of the data, and (2) Plaintiffs’ Wiretap Act claims should be dismissed because
`
`the websites consented to Google’s receipt of the data. Id. at 9–13. The Court addresses each
`
`argument in turn.
`1. Google has not shown that Plaintiffs consented.
`Consent is a defense to Plaintiffs’ claims. See 18 U.S.C. § 2511(2)(d) (Wiretap Act)
`
`(providing that it is not “unlawful . . . for a person . . . to intercept a[n] . . . electronic
`
`communication . . . where one of the parties to the communication has given prior consent to such
`
`interception”); Cal. Pen. Code §§ 631(a), 632(a) (CIPA) (prohibiting wiretapping and
`
`eavesdropping “without the consent of all parties to the communication”); Cal. Pen. Code §
`
`502(c)(2) (CDAFA) (providing that a person who “knowingly accesses and without permission
`
`takes, copies, or makes use of any data” is guilty of a public offense); Smith v. Facebook, Inc., 262
`
`F. Supp. 3d 943, 955–56 (N.D. Cal. 2017), aff’d, 745 F. App’x 8 (9th Cir. 2018) (“Plaintiff’s
`
`consent . . . bars their common-law tort claims and their claim for invasion of privacy under the
`
`California Constitution.”). Accordingly, Google contends that Plaintiffs consented to Google’s
`
`alleged data collection while they were in private browsing mode. Mot. at 10–11.
`
`“[A]s ‘the party seeking the benefit of the exception,’ it is Google’s burden to prove
`
`consent.” Matera v. Google Inc., 2016 WL 5339806, at *17. Consent “can be explicit or implied,
`
`but any consent must be actual.” In re Google, Inc., 2013 WL 5423918, at *12 (N.D. Cal. Sept.
`
`26, 2013). In order for consent to be actual, the disclosures must “explicitly notify” users of the
`
`practice at issue. Id. at *13; see also Campbell v. Facebook, Inc., 77 F. Supp. 3d 836, 847–48
`
`(N.D. Cal. 2014) (explaining that, for a finding of consent, the disclosures must have given users
`
`notice of the “specific practice” at issue). The disclosures must have only one plausible
`
`interpretation for a finding of consent. In re Facebook, Inc., Consumer Privacy User Profile Litig.,
`
`402 F. Supp.