Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 1 of 32
`
`
`
`WILLKIE FARR & GALLAGHER LLP
`Benedict Y. Hur (SBN: 224018)
`Simona Agnolucci (SBN: 246943)
`Eduardo E. Santacana (SBN: 281668)
`Tiffany Lin (SBN: 321472)
`One Front Street, 34th Floor
`San Francisco, CA 94111
`Telephone: (415) 858-7400
`Facsimile: (415) 858-7599
`bhur@willkie.com
`sagnolucci@willkie.com
`esantacana@willkie.com
`tlin@willkie.com
`
`Attorneys for
`GOOGLE LLC
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`SAN JOSE DIVISION
`
`
`JONATHAN DIAZ and LEWIS
`BORNMANN, on behalf of themselves
`and all others similarly situated,
`Plaintiff,
`
`v.
`GOOGLE LLC,
`
`Defendant.
`
`
`
`Case No. 5:21-cv-03080 NC
`
`DEFENDANT GOOGLE LLC’S
`NOTICE OF MOTION AND MOTION
`TO DISMISS THE FIRST AMENDED
`COMPLAINT PURSUANT TO FED.
`R. CIV. P. 12(B)(1) AND 12(B)(6)
`
`
`Judge:
`Court:
`Date:
`Time:
`
`Hon. Nathanael Cousins
`Courtroom 5 – 4th Floor
`October 27, 2021
`1:00 p.m.
`
`
`
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 2 of 32
`
`
`
`TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD:
`PLEASE TAKE NOTICE THAT, on October 27, 2021 at 1:00 p.m., the undersigned will
`appear before the Honorable Nathanael Cousins of the United States District Court for the
`Northern District of California at the San Jose Courthouse, Courtroom 5, 4th Floor, 280 South 1st
`Street, San Jose, CA 95113, and shall then and there present Defendant Google LLC (“Google”)’s
`Motion to Dismiss the First Amended Complaint (“Motion”).
`Google brings this Motion under Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil
`Procedure. Google will, and hereby does, move for an order dismissing the First Amended
`Complaint (“FAC”) with prejudice because any additional amendment of the FAC would be futile.
`The Motion is based on this Notice of Motion and Motion, the following Memorandum of Points
`and Authorities, Google’s Request for Judicial Notice, the Declaration of Tiffany Lin, and exhibits
`attached thereto, the pleadings and other papers on file in this action, any oral argument, and any
`other evidence that the Court may consider in hearing this Motion.
`ISSUES PRESENTED
`
`Whether Plaintiffs’ FAC should be dismissed for lack of subject-matter jurisdiction under
`Federal Rule of Civil Procedure 12(b)(1) where Plaintiffs lack Article III standing; whether
`Plaintiffs’ FAC should be dismissed pursuant to Federal Rule of Civil Procedure 12(b)(6) for
`failure to state a claim upon which relief can be granted; and whether the FAC should be
`dismissed with prejudice where any additional amendment would be futile.
`
`WILLKIE FARR & GALLAGHER LLP
`
`Date: August 25, 2021
`
`By: ____/s/ Benedict Y. Hur_____________
`Benedict Y. Hur
`Simona Agnolucci
`Eduardo E. Santacana
`Tiffany Lin
`
`Attorneys for Defendant
`Google LLC
`
`
`
`
`2
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 3 of 32
`
`
`
`I. 
`II. 
`
` 
`
` 
`
`TABLE OF CONTENTS
`INTRODUCTION ...............................................................................................................1 
`BACKGROUND .................................................................................................................2 
`A. 
`Relevant Procedural History ....................................................................................2 
`B. 
`Relevant Factual Background ..................................................................................2 
`Exposure Notification System .....................................................................2 
`Plaintiffs’ Allegations ..................................................................................4 
` 
`III.  RULE 12(B)(1) MOTION TO DISMISS ............................................................................6 
`A. 
`Legal Standard .........................................................................................................6 
`C. 
`Argument .................................................................................................................7 
`Plaintiffs lack Article III standing. ...............................................................7 
`a. 
`Plaintiffs’ alleged injury is not concrete or particularized. ...............7 
`b. 
`Plaintiffs’ alleged injury is not fairly traceable. ..............................11 
`c. 
`Plaintiffs’ alleged injury is not redressable. ....................................12 
`IV.  RULE 12(B)(6) MOTION TO DISMISS ..........................................................................13 
`A. 
`Legal Standard .......................................................................................................13 
`B. 
`Argument ...............................................................................................................13 
`Plaintiffs fail to state a claim for public disclosure of private facts
`because there was no public disclosure. ....................................................13 
`Plaintiffs fail to state a claim for intrusion upon seclusion or invasion
`of privacy because the alleged intrusion was not intentional or highly
`offensive. ....................................................................................................15 
`Plaintiffs fail to state a claim under the CMIA because Google is not a
`provider of health care and Plaintiffs’ medical information has not
`been collected, disclosed, or viewed. .........................................................18 
`a. 
`Google is not a provider of health care under the CMIA. ...............18 
`b. 
`The app does not collect medical information. ...............................22 
`c. 
`Plaintiffs are not “patients” of Google. ...........................................23 
`d. 
`Plaintiffs have not pled that disclosure of medical information
`occurred under section 56.10. ..........................................................24 
`
` 
`
` 
`
` 
`
`i
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 4 of 32
`
`
`
`e. 
`
`Plaintiffs have not alleged that the medical information was viewed
`by an unauthorized person, as required by sections 56.101 and
`56.36. ...............................................................................................24 
`V.  AMENDMENT WOULD BE FUTILE .............................................................................25 
`VI.  CONCLUSION ..................................................................................................................25 
`
`
`
`ii
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 5 of 32
`
`
`
`Cases
`
`TABLE OF AUTHORITIES
`
` Page(s)
`
`Ashcroft v. Iqbal,
`556 U.S. 662 (2009) .................................................................................................................13
`
`Bassett v. ABM Parking Servs., Inc.,
`883 F.3d 776 (9th Cir. 2018) ...................................................................................................10
`
`Bell Atl. Corp. v. Twombly,
`550 U.S. 544 (2007) .................................................................................................................13
`
`Carrico v. City & Cnty. of San Francisco,
`656 F.3d 1002 (9th Cir. 2011) .................................................................................................13
`
`Clapper v. Amnesty Intern. USA,
`568 U.S. 398 (2013) ...................................................................................................7, 9, 11, 12
`
`Eisenhower Medical Center v. Superior Court,
`172 Cal. Rptr. 3d 165 (Ct. App. 2014)...................................................................19, 20, 21, 23
`
`In re Facebook, Inc. Internet Tracking Litig.,
`956 F.3d 589 (9th Cir. 2020) .............................................................................................15, 16
`
`Fernandez v. Leidos, Inc.,
`127 F. Supp. 3d 1078 (E.D. Cal. 2015)....................................................................................10
`
`In re Gilead Scis. Secs. Litig.,
`536 F.3d 1049 (9th Cir. 2008) .................................................................................................13
`
`In re Google, Inc. Privacy Policy Litig.,
`58 F. Supp. 3d 968 (N.D. Cal. 2014) .............................................................................8, 11, 18
`
`Hill v. Nat’l Collegiate Athletic Ass’n,
`7 Cal. 4th 1 (1994) ...................................................................................................................16
`
`In re iPhone Application Litig.,
`844 F. Supp. 2d 1040 (N.D. Cal. 2012) .............................................................................16, 18
`
`Jewel v. National Security Agency,
`673 F.3d 902 (9th Cir. 2011) ...................................................................................................10
`
`Kingman Reef Atoll Inv., LLC v. United States,
`541 F.3d 1189 (9th Cir. 2008) ...................................................................................................6
`
`Low v. LinkedIn Corp.,
`900 F. Supp. 2d 1010 (N.D. Cal. 2012) .........................................................................9, 16, 18
`iii
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 6 of 32
`
`
`
`Low v. LinkedIn Corp.,
`No. 11-CV-01468-LHK, 2011 WL 5509848 (N.D. Cal. Nov. 11, 2011) ................................11
`
`Lujan v. Defenders of Wildlife,
`504 U.S. 555 (1992) ...................................................................................................................6
`
`McDonald v. Kiloo ApS,
`385 F. Supp. 3d 1022 (N.D. Cal. 2019) ...................................................................................16
`
`Miller v. Rykoff-Sexton, Inc.,
`845 F.2d 209 (9th Cir. 1988) ...................................................................................................13
`
`Naruto v. Slater,
`888 F.3d 418 (9th Cir. 2018) .....................................................................................................6
`
`Navarro v. Block,
`250 F.3d 729 (9th Cir. 2001) ...................................................................................................13
`
`Opperman v. Path, Inc.,
`205 F. Supp. 3d 1064 (N.D. Cal. 2016) ...................................................................................15
`
`Opperman v. Path, Inc.,
`87 F. Supp. 3d 1018 (N.D. Cal. 2014) .........................................................................13, 14, 17
`
`Pettus v. Cole,
`57 Cal. Rptr. 2d 46 (Ct. App. 1996).........................................................................................23
`
`Razuki v. Caliber Home Loans, Inc.,
`No. 17-cv-1718-LAB (WVG), 2018 WL 2761818 (S.D. Cal. June 7, 2018) ...................16, 17
`
`Regents of University of California v. Superior Court,
`163 Cal. Rptr. 3d 205 (Ct. App. 2013).....................................................................................19
`
`Stasi v. Inmediata Health Group Corp.,
`No. 19cv2353 JM (LL), 2020 WL 6799437 (S.D. Cal. Nov. 19, 2020) ..................................24
`
`Sutter Health v. Superior Court,
`174 Cal. Rtpr. 3d 653 (Ct. App. 2014).........................................................................19, 24, 25
`
`Taus v. Loftus,
`40 Cal. 4th 683 (2007) .............................................................................................................14
`
`TransUnion LLC v. Ramirez,
`141 S. Ct. 2190, 2212 (2021) .....................................................................................................9
`
`Varnado v. Midland Funding LLC,
`43 F. Supp. 3d 985 (N.D. Cal. 2014) .......................................................................................15
`
`Virginia House of Delegates v. Bethune-Hill,
`139 S. Ct. 1945 (2019) ...............................................................................................................6
`
`iv
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 7 of 32
`
`
`
`Yunker v. Pandora Media Inc.,
`No. 11-CV-03113 JSW, 2013 WL 1282980 (N.D. Cal. Mar. 26, 2013) .................................11
`
`In re Zoom Video Comms. Inc. Privacy Litig.,
`No. 20-CV-02155-LHK, 2021 WL 930623 (N.D. Cal. Mar. 11, 2021) ..................................16
`
`Constitutional Authorities
`
`California Constitution Article I, Section 1 .............................................................1, 2, 15, 16, 18
`
`Statutes
`
`Cal. Civ. Code §§ 56 et seq. ................................................................................................. passim
`
`Cal. Civ. Code § 56.06(a) ..........................................................................................19, 20, 21, 22
`
`Cal. Civ. Code § 56.06(b) ................................................................................................19, 20, 21
`
`Cal. Civ. Code § 56.101 ...............................................................................................................18
`
`Cal. Civ. Code § 56.05 ...........................................................................................................20, 23
`
`Cal. Civ. Code § 56.10 ...........................................................................................................18, 24
`
`Other Authorities
`
`Federal Rule of Civil Procedure 12(b)(1) ................................................................................6, 12
`
`Federal Rule of Civil Procedure 12(b)(6) ....................................................................................13
`
`
`
`
`v
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 8 of 32
`
`
`
`MEMORANDUM OF POINTS AND AUTHORITIES
`I.
`INTRODUCTION
`In early 2020, as the world was grappling with the COVID-19 pandemic, Google and
`Apple, Inc. teamed up to develop technology to meet the needs of public health authorities to
`quickly and efficiently conduct digital contact tracing to slow the spread of COVID-19. The
`resulting Exposure Notification System (“EN System”) was developed with robust privacy
`protections in place. Over the past year, the EN System has been used by millions of users and
`dozens of public health authorities around the world. Google and Apple made the technology
`available free of charge.
`Apparently no good deed goes unpunished. Plaintiffs Jonathan Diaz and Lewis Bornmann
`do not allege that the EN System disclosed personally identifiable information (“PII”) to anyone.
`Their claims instead hinge on an entirely hypothetical theory that unrelated apps engaged in an
`increasingly remote and malicious series of steps to attempt to learn something from crash-
`reporting logs. But they don’t allege that any bad actor has gone to the lengths that would be
`necessary to decipher a user's identity, decipher the information logged by the EN System, and
`make guesses or inferences about the user’s activity within the app. They merely allege it is
`theoretically possible that someone could have done that. This is thus a textbook case about a
`hypothetical risk of harm that is not, in any event, fairly traceable to Google’s conduct.
`Google moved to dismiss once already, and rather than oppose, Plaintiffs responded by
`amending their complaint. The First Amended Complaint (“FAC”) adds many words but still
`lacks factual allegations showing that an individual’s use of the EN System was ever used to
`identify an individual and their COVID-19 test result, and the explanations for how that might be
`possible are convoluted and theoretical.
`Google now moves to dismiss Plaintiffs’ FAC with prejudice because: (1) Plaintiffs have
`failed to establish Article III standing; (2) Plaintiffs cannot state a claim for privacy violations
`under California common law, the California Constitution, or the California Confidentiality of
`Medical Information Act (“CMIA”); and (3) any additional amendment of the FAC would be
`futile.
`
`1
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 9 of 32
`
`
`
`II. BACKGROUND
`A. Relevant Procedural History
`Plaintiffs filed a Class Action Complaint on April 27, 2021. ECF 1. Google filed a Motion
`to Dismiss the Complaint on June 29, 2021. ECF 18. In lieu of opposing Google’s Motion to
`Dismiss, Plaintiffs filed a FAC on July 20, 2021. ECF 24. The FAC alleges the following claims:
`(1) public disclosure of private facts; (2) intrusion upon seclusion; (3) violation of Article I,
`Section 1 of the California Constitution; and (4) violation of the CMIA.
`B. Relevant Factual Background
` Exposure Notification System
`
`
`
`In early 2020, Google and Apple developed the Exposure Notification System that uses
`applications on mobile devices to aid in digital contact tracing efforts.1 FAC ¶¶ 12–17. The goal of
`the EN System is to assist public health authorities in their efforts to fight COVID-19 by enabling
`exposure notifications in a privacy-preserving manner.2 Google and Apple have released software
`tools called Application Programming Interfaces (“APIs”) that enable public health authorities to
`build mobile applications to help with COVID-19 contact tracing efforts across Android and iOS
`devices in a privacy-protective way.3 The EN System can be used only to support approved
`contact tracing apps of authorized public health authorities.4 Some public health authorities have
`built apps that use the EN System, some use a template app developed and supported by Google,
`and other public health authorities offer contact tracing using the EN System without creating an
`app (CA Notify on iOS devices is one example).5 FAC ¶¶ 16–21. In all cases, in order to enable
`
`
`1 See Google’s RJN Ex. 1, Use the COVID-19 Exposure Notifications System on your Android
`phone, Google Play Help, https://support.google.com/googleplay/answer/9888358?hl=en (last
`visited August 6, 2021); Google’s RJN Ex. 2, Exposure Notifications: Using technology to help
`public authorities fight COVID-19, Google COVID-19 Information and Resources,
`https://web.archive.org/web/20201201225451/https://www.google.com/covid19/exposurenotificat
`ions/ (last visited August 6, 2021); Google’s RJN Ex. 3, Exposure Notifications: Frequently Asked
`Questions, September 2020 v1.2, https://covid19-static.cdn-
`apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-
`FAQv1.2.pdf.
`2 See Google’s RJN Ex. 3.
`3 Id.
`4 Id.
`5 Id.; Google’s RJN Ex. 1.
`
`2
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 10 of 32
`
`
`
`the EN System, the user must activate exposure notifications and consent to the terms and
`conditions of their public health authority’s contact-tracing app or services.6 FAC ¶¶ 19–26.
`Google and Apple committed not to monetize the EN System, and to disable it on a regional basis
`when it is no longer needed.7
`Once the EN System is enabled by the user, the user’s device will periodically send out a
`beacon via Bluetooth that includes a Rolling Proximity Identifier (“RPI”): a string of random
`numbers that aren’t tied to a user’s identity and that changes every 15 to 20 minutes.8 FAC ¶¶ 29–
`31. When two phones with the EN System enabled come into proximity of one another, they
`exchange their then-current RPIs, which are stored on the devices.9 Id. ¶ 30. The devices also
`generate a Temporary Exposure Key (“TEK”) that changes every 24 hours. Id. ¶¶ 27–28. Neither
`RPIs nor TEKs contain personal information. Id. ¶¶ 27, 29. RPIs and TEKs are stored on users’
`devices, and after 14 days they are deleted.10
`If a user receives a positive COVID-19 test result, a local public health authority can
`provide the user with a verification code to report that test result in the health authority’s app. Id. ¶
`38. After the test result is reported, the EN System enables the user to choose to upload the TEKs
`generated over the last 14 days on their device.11 Id. Public health authorities designate a server to
`maintain a list of TEKs associated with users who have reported a positive test result.12 Apps
`using the EN System periodically download and compare the list of TEKs of users who have
`reported a positive test result to the list of RPIs each user has come into contact with over the past
`14 days. Id. ¶ 40. If the EN System determines that a user has come into contact with an RPI
`generated by a TEK associated with a user who reported a positive test result, the health
`authority’s app can display an exposure notification to the potentially exposed user. Id. ¶ 42. The
`
`
`6 Google’s RJN Ex. 4: CA Notify: Apps on Google Play, Google Play,
`https://play.google.com/store/apps/details?id=gov.ca.covid19.exposurenotifications (last visited
`August 6, 2021).
`7 Google’s RJN Ex. 3.
`8 Id.
`9 Id.
`10 Google’s RJN Ex. 4.
`11 See also Google’s RJN Ex. 3.
`12 Id.
`
`3
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 11 of 32
`
`
`
`exposure notification alerts the potentially exposed user that they have recently come in contact
`with someone who has tested positive for COVID-19 and provides the health authority’s guidance
`on next steps.13 The EN System shares with the health authority the day the contact occurred, how
`long it lasted, the Bluetooth signal strength of that contact, and the type of report that confirmed
`the test result.14 The EN System was designed so that users decide whether to share their COVID-
`19 diagnosis with their local public health authority, and they are not identified to other users.15
`CA Notify is California’s implementation of the EN System. The December 2020 CA
`Notify Privacy Policy provides that the following categories of de-identified data may be
`processed and collected by CA Notify: (1) Installing and deleting the app (Android only); (2)
`Enabling and disabling exposure notifications; (3) Receiving an exposure notification; (4)
`Entering a verification code to send anonymous keys; (5) Anonymous keys that have been
`voluntarily shared.16 The policy states, “[t]he data may also be shared with local public health
`authorities and the University of California. This information will not include any personal or
`location information, nor can it be used to identify any system user.”17 The policy also provides
`that, though a user’s identity is not shared, “[i]t is possible that someone who receives an exposure
`notice could guess the identity of the COVID-19 positive individual, if they had a limited number
`of contacts on a given day.”18
` Plaintiffs’ Allegations
`
`The FAC alleges19 that the EN System produced three types of log entries in Android
`system logs meant for crash reporting: (1) the user’s Bluetooth RPIs; (2) an “activity”20 that starts
`
`
`
`
`13 Google’s RJN Ex. 3.
`14 Id.
`15 Id.
`16 Google’s RJN Ex. 5, Privacy Policy, CA Notify, https://covid19.ca.gov/notify-privacy/
`(effective Dec. 10, 2020).
`17 Id.
`18 Id. Public health authorities that use Google’s EN service must comply with the Google
`COVID-19 Exposure Notifications Service Additional Terms as well as Google’s API Terms of
`Service. Google COVID-19 Exposure Notifications Service Additional Terms (May 4, 2020),
`https://blog.google/documents/72/Exposure_Notifications_Service_Additional_Terms.pdf.
`19 As it must, Google treats the allegations of the FAC as true for purposes of this motion.
`20 Plaintiffs refer to an “activity” in the Android Operating System as “a discrete screen within the
`application.” FAC ¶ 81.
`
`4
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 12 of 32
`
`
`
`when a user elects to report a positive COVID-19 test result named “ShareDiagnosisActivity”; and
`relatedly, (3) an entry reflecting that the user had taken steps to upload TEKs to the public health
`authority. FAC ¶¶ 57–59; 76–77; 84–88. Plaintiffs allege that Google, certain applications on
`Android devices, and third-party entities affiliated with those apps, have permission to access the
`crash-reporting logs. Id. ¶¶ 60–66. Plaintiffs also allege that Google, device manufacturers, and
`mobile network operators collect information from the crash-reporting logs. Id. ¶¶ 91–92. Finally,
`Plaintiffs allege that the entities with access to the crash-reporting logs can “associate the data that
`[the EN System] logs with the device owner’s identity.” Id. ¶ 98. Plaintiffs allege that users of
`Apple iPhone devices are also harmed because “the RPIs [the iPhone] transmits are being logged
`with identifying information by Android devices running [the EN System], from which it is
`communicated to Google and perhaps dozens of other third parties.” Id. ¶ 114. Plaintiffs don’t
`allege that anybody reviewed the log to determine whether a particular user reported a positive
`COVID-19 test result.
`Furthermore, nothing in the FAC alleges that any facet of the EN System itself logs PII. It
`doesn’t. The only piece of information logged by the EN System that Plaintiffs allege could be
`characterized as “identifying information” is a user’s randomized MAC address. Though Plaintiffs
`acknowledge that MAC addresses are “string[s] of characters” that “are randomized before
`broadcast,” Plaintiffs allege that “randomized MAC addresses can be associated with specific
`locations,” FAC ¶ 103. But the lone 2017 study that Plaintiffs cite for this concept contains highly
`technical de-randomization techniques and, most importantly, appears to conclude that the main
`issue “is that the overwhelming majority of Android devices are not implementing the available
`randomization capabilities built into the Android OS.”21 This study is entirely inapplicable to the
`instant situation where Plaintiffs admit the EN System uses randomized MACs. FAC ¶ 34.
`Because the EN System does not log PII, Plaintiffs allege instead that the same crash-
`reporting logs to which the EN System logs data may contain PII that was included by others
`
`
`21 FAC ¶ 103 n. 52. Plaintiffs also cite to two inapposite news articles that appear to conclude that
`MAC addresses that are not randomized or anonymized can be used by retail analytics providers
`to track devices, but anonymization or randomization of MAC addresses may prevent tracking and
`improve smartphone privacy. See FAC ¶ 194 n. 53.
`5
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 13 of 32
`
`
`
`against Google’s guidance, and that yet another entity could then collect that data at exactly the
`right time and combine it to link a person’s identity to their decision to report a positive COVID-
`19 test result. See FAC ¶¶ 74; 98–99; 104–10.
`Plaintiffs allege that Named Plaintiffs Lewis Bornmann and Jonathan Diaz downloaded
`and activated the CA Notify app on Android devices in December 2020. Id. ¶¶ 124, 129. Plaintiffs
`do not allege whether Bornmann entered a positive test result into the CA Notify app, nor whether
`he interacted with the App in any way after installing and activating the app. Id. ¶¶ 124–28.
`The FAC explains that Google began “rolling out patch fixes” to change the logging in late
`March 2021. Id. ¶ 117. Plaintiffs allege that the logging of RPIs, activity names that purportedly
`reflect a user making a report, and entries purportedly showing that a user had taken steps to
`upload TEKs to the public health authority by the EN System code occurred until at least April or
`May 2021. Id. ¶¶ 76–77; 86–88; 117–21. Plaintiffs do not allege that there is any present feature
`of the EN System that violates their rights. Id.
`III. RULE 12(B)(1) MOTION TO DISMISS
`Legal Standard
`It is the plaintiff’s burden to establish subject-matter jurisdiction.22 See Kingman Reef Atoll
`Inv., LLC v. United States, 541 F.3d 1189, 1197 (9th Cir. 2008). “[L]ack of Article III standing
`requires dismissal for lack of subject matter jurisdiction under Federal Rule of Civil Procedure
`12(b)(1).” Naruto v. Slater, 888 F.3d 418, 425 n.7 (9th Cir. 2018). To establish Article III
`standing, the plaintiff must show: “(1) a concrete and particularized injury, that (2) is fairly
`traceable to the challenged conduct, and (3) is likely to be redressed by a favorable decision.”
`Virginia House of Delegates v. Bethune-Hill, 139 S. Ct. 1945, 1950 (2019). The injury must be
`“(a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.”
`Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992).
`“[S]tanding theories that require guesswork as to how independent decisionmakers will
`exercise their judgment” or “rest on speculation about the decisions of independent actors” do not
`
`A.
`
`
`22 Internal citations and quotation marks have been omitted and emphases added unless otherwise
`noted.
`
`6
`DEFENDANT GOOGLE LLC’S MOTION TO DISMISS THE FIRST AMENDED COMPLAINT
`Case No. 5:21-cv-03080 NC
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:21-cv-03080-NC Document 37 Filed 08/25/21 Page 14 of 32
`
`
`
`meet the “certainly impending” and “fairly traceable” requirements for Article III standing. See
`Clapper v. Amnesty Intern. USA, 568 U.S. 398, 413 (2013).
`C. Argument
` Plaintiffs lack Article III standing.
`
`
`
`Plaintiffs lack Article III standing because their alleged injury is not (1) concrete or
`particularized; (2) fairly traceable to the challenged conduct; or (3) would not be redressed by a
`favorable decision.
`a. Plaintiffs’ alleged injury is not concrete or particularized.
`
`
`
`i. Plaintiffs’ allegations rest upon a highly attenuated chain of possibilities.
`Plaintiffs cannot show that they have suffered, or will imminently suffer, a concrete or
`particularized injury. Plaintiffs’ argument rests on the highly speculative fear that, despite the
`temporary nature of the data logged into the crash-reporting log, the privacy-protective design of
`the TEKs and RPIs, the technical and standardized nature of the information logged about the EN
`System’s operation, the limited access to the crash-reporting log and TEK list, the regeneration of
`random TEKs every 24 hours and random RPIs every 15 minutes, and the various privacy policies
`and protections in place, a bad actor could seek to collect and comb through this data at exactly
`the right moment and combine the non-PII contained in the crash-reporting logs in order to infer
`the identity of someone who reported a positive COVID-19 test result. See FAC ¶ 98.
`Plaintiffs allege in conclusory fashion that “[t]he exposed [crash-reporting log] information
`is personally identifiable.” FAC at 1. Plaintiffs rest their allegation on the assumptions that: (1)
`randomized MAC addresses are “identifying information”; (2) the