RODRIGUEZ v. AUTOTRADER COM INC (2025)

Proceedings: (IN CHAMBERS) Order Re: Defendant's Motion to Dismiss [DE 15]

I. INTRODUCTION

On September 10, 2024, Rebeka Rodriguez (“Plaintiff”) filed the operative First Amended Class Action Complaint (“FAC”) against Autotrader.com, Inc. (“Defendant”) in state court. (ECF No. 1-1.) Plaintiff asserts claims for invasion of privacy under California Penal Code §§ 631 and 638.51.¹ On October 10, 2024, Defendant removed the action under the Class Action Fairness Act. (ECF No. 1.)

Presently before the Court is Defendant's Motion to Dismiss. (ECF No. 15.) For the following reasons, the Court GRANTS the Motion in part.

II. FACTUAL BACKGROUND

Plaintiff alleges the following in the FAC:

Defendant operates the website Autotrader.com (the “Website”). When a visitor visits the Website, the Website immediately installs third-party tracking software on the visitor's browser before the visitor has any opportunity to consent or decline the Website's privacy policy. This software collects various types of information about the visitor to deliver targeted advertising. This information includes IP addresses, operating system information, browser information, geolocation data, and email addresses. This software remains installed on the browser unless the visitor decides to delete it. However, if the visitor visits the Website again, it is reinstalled.

Once the Website loads, the visitor may enter queries into a search bar provided by an unknown third party. When a visitor enters a query, the query is routed to that unknown third party and shared with other third parties like Google, Facebook, Pinterest, and various other advertising services.

In March 2024, Plaintiff, a “tester”² that seeks out privacy violations, visited the Website. Immediately upon visiting the Website, the Website installed tracking software on her browser, which captured and sent identifying information to third parties. She also made a search query containing “confidential” and “private” information which was shared with multiple third parties without her consent or permission. (FAC ¶ 87.)

III. JUDICIAL STANDARD

Under Federal Rule of Civil Procedure (“Rule”) 8(a), a complaint must contain a “short and plain statement of the claim showing that the [plaintiff] is entitled to relief.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). If a complaint fails to adequately state a claim for relief, the defendant may move to dismiss the claim under Rule 12(b)(6) to dismiss for failure to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). A claim is facially plausible if the plaintiff alleges enough facts to allow the court to draw a reasonable inference that the defendant is liable. Id. A plaintiff need not provide detailed factual allegations, but must provide more than mere legal conclusions. Twombly, 550 U.S. at 555. However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678.

When ruling on a 12(b)(6) motion, the court must accept the allegations in the complaint as true and construe them in the light most favorable to the non-moving party. Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). “Factual allegations must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. Dismissal is “appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008).

IV. DISCUSSION

Plaintiff asserts claims for invasion of privacy under California Penal Code §§ 631 and 638.51. Defendant moves to dismiss each claim. The Court addresses each claim in turn.

A. Section 631

Section 631 contains three clauses, each prohibiting a “distinct and mutually independent pattern[ ] of conduct.” Tavernetti v. Super. Ct., 22 Cal. 3d 187, 192 (1978). Clauses one through three, respectively, prohibit: (1) intentional wiretapping; (2) willful attempts to learn the contents of communications; and (3) the use of any information obtained through the activities proscribed in the first two clauses. Id. In addition to its own primary violations of the statute, a defendant may also be held liable for aiding a third party's violation of the statute. Cal. Penal Code § 631(a).

Plaintiff appears to assert that Defendant violated clauses two and three of § 631 by sharing her search queries with third parties. Defendant argues that this claim fails because: (1) Plaintiff lacks standing; (2) the party exception applies; (3) Plaintiff fails to allege that any information was intercepted in transit; and (4) Plaintiff consented to her information being shared. The Court addresses each argument in turn.

1. Standing

Article III of the Constitution limits the jurisdiction of federal courts to “Cases” and “Controversies.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). One of the essential components of the Article III case-or-controversy requirement is that a plaintiff must have standing. Id. For a plaintiff to have standing, it must establish: (1) an injury in fact; (2) that is traceable to the challenged conduct of the defendant; and (3) is likely to be “redressed by a favorable decision.” Id. at 560–561.

To show an injury in fact, a plaintiff must allege “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Id. at 560. Congress may not “enact an injury into existence” merely by granting a right to sue, and therefore there is no automatic satisfaction of the injury-in-fact requirement just because a plaintiff has a statutory right to sue. Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). Instead, “[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue ․ in federal corut.” TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) (emphasis in original).

Defendant argues that Plaintiff lacks standing because she lacks an injury in fact. Specifically, Defendant argues that Plaintiff must show she was concretely harmed as a result of Defendant's alleged sharing of her search queries by showing that her search query contained sensitive information that could cause harm if disclosed. Defendant suggests Plaintiff fails to make this showing because she merely states in a conclusory manner that her query contained “confidential” and “private” information. (FAC ¶ 87.) Plaintiff does not dispute that she describes her query in a conclusory manner. Instead, she argues that a violation of § 631 is by itself an injury in fact sufficient to confer standing; the nature of the information is irrelevant.

The Court agrees with Defendant. Whether the right to privacy is implicated depends on “the sort of information revealed.” Norman-Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1271 n.17 (9th Cir. 1998); see also Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855, 864 (S.D. Cal. 2023) (collecting cases). Not all information will qualify; the information must be sufficiently personal or sensitive that its disclosure is harmful. Mikulsky, 682 F. Supp. 3d at 864 (citing Byars v. Sterling Jewelers, Inc., 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023)). Because Plaintiff fails to describe the contents of her query, she fails to demonstrate that she suffered an injury in fact.

a. Leave to Amend

In her Opposition, Plaintiff requests leave to amend. Under Rule 15(a), courts “should freely give leave when justice so requires,” and deny leave only when amendment would be futile, unduly prejudice the opposing party, cause undue delay, or if the moving party has acted in bad faith. Fed. R. Civ. P. 15(a)(2); Leadsinger, Inc. v. BMG Music Publ'g, 512 F.3d 522, 532 (9th Cir. 2008).

Here, it appears that Plaintiff could cure this defect on amendment. However, because Defendant raises several alternative arguments, the Court addresses the remaining arguments to determine whether amendment would be futile.

2. Party Exception

Under the “party exception,” an entity that is a “party to the communication” at issue is exempt from liability under § 631. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn, 99 Cal. App. 3d 805, 811 (1979)) (internal quotation marks omitted). Plaintiff argues that Defendant aided third parties in violating § 631 by rerouting and sharing her search queries with them. Defendant argues that the party exception applies because these third parties were not acting as separate entities, but as tools for Defendant's use in providing the Website's services.

As this Court previously explained in Garcia v. Yeti Coolers, LLC, two seminal California cases define the contours of the party exception. 2023 WL 5736006, at *2 (C.D. Cal. Sept. 5, 2023). The first, Rogers v. Ulrich, involved a defendant who recorded a conversation between himself and the plaintiff with a tape recorder and later shared the recording with a third party. 52 Cal. App. 3d 894, 897-98 (1975). The court held that the party exception applied because the tape recorder was a tool, not a separate entity, and defendant's sharing of recording after the fact did not meet the “in transit” requirement discussed below. Id. at 899. The second, Ribas v. Clark, involved a defendant that listened in real time to a private telephone conversation between the plaintiff and a third party. 38 Cal. 3d 355, 358 (1985). The court held that the party exception might not apply, reasoning that there is “a substantial distinction ․ between the secondhand repetition of the contents of a conversation and its simultaneous dissemination to an unannounced second auditor, whether that auditor be a person or mechanical device.” Id. at 360-61.

Recently, many California district courts have been tasked with determining whether third-party monitoring of customer website activity is more akin to the tape recorder in Rogers, or the eavesdropper in Ribas. Courts are split in their approaches.

Some courts have reasoned that website monitoring software is merely a tool enabling later playback like the tape recorder in Rogers, falling under the party exception. For example, one court reasoned that a chat support software provider “captures its clients’ data, hosts it on [its] servers, and allows the clients to analyze their data․ It provides a tool—like the tape recorder in Rogers—that allows [the defendant] to record and analyze its own data in aid of [the defendant's] business.” Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021).

By contrast, other courts have posited that monitoring companies are separate corporate entities more accurately analogized to the defendant in Ribas. See, e.g., Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 520 (C.D. Cal. 2021) (reasoning that a company providing website monitoring software to the defendant “is a separate legal entity ․ and not merely a passive device.”). These courts have distinguished website monitoring software from the simple mechanical device used in Rogers, since the alleged capabilities of the software are “beyond the ordinary function of a tape recorder.” Javier v. Assurance IQ, LLC, 2023 WL 114225, at *6 (N.D. Cal. Jan. 5, 2023) (quoting Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1080 (C.D. Cal. 2021)).

Here, Plaintiff alleges that search queries are routed to the third-party search engine provider and other third-party advertising companies. While there is certainly room to debate whether the provider fits within the party exception, it appears that the advertising companies would not. As alleged, there is no indication that the advertising companies are merely providing a tool that aids the Website. Thus, this argument fails.

3. In Transit

To establish a violation of clauses two and three, a plaintiff must show that a party willfully read or attempted to read the contents of a private communication while the message was in transit. Cal. Penal Code § 631(a).

Here, Plaintiff alleges that search queries are intercepted by third parties while in transit. Defendant argues that these allegations are conclusory and lack specificity. The Court disagrees. Plaintiff bolsters her allegations by alleging that her queries were rerouted to the third-party search engine provider, and that those queries were also shared with advertising companies. (FAC 99-109.) While not explicit as to whether these events occurred at the moment of transmission or immediately after, these allegations create a reasonable inference that her queries were read during transit. Thus, this argument also fails.

4. Consent

In addition to showing that the message was intercepted in transit, a plaintiff must also show that it was intercepted without her consent. Cal. Penal Code § 631(a).

Here, Plaintiff alleges that she did not consent to Defendant sharing her search queries with third parties. Defendant argues that this allegation is not credible because the Website has a banner that explicitly informs visitors that their information would be shared with third parties, and thus, Plaintiff implicitly consented by using the search bar after being given notice. The Court disagrees. Whether Plaintiff implicitly consented turns on whether the banner was sufficiently conspicuous and whether it sufficiently disclosed how Defendant would use her data. See Valenzuela v. Kroger Co., 2024 WL 1336959, at *3 (C.D. Cal. Mar. 28, 2024). Plaintiff does not allege any details about the banner. Nor does Defendant provide any details about the banner via judicial notice.³ Absent such details, Plaintiff's uncontradicted allegation is accepted as true. Thus, this argument also fails.

Having found that Defendant's remaining arguments fail, it appears that Plaintiff's claim is not futile. Accordingly, the Court DISMISSES Plaintiff's § 631 claim without prejudice.

B. Section 638.51

Section 638.51 prohibits the use of pen registers and trap and trace devices, which are “device[s] or process[es]” that record or capture “dialing, routing, addressing, or signaling information” from a “wire or electronic communication,” “but not the contents of a communication.” Cal. Penal Code §§ 638.50(b)–(c); 638.51. To state a claim under § 638.51, a plaintiff must allege that a defendant installed and used a pen register or trap and trace device without first obtaining a court order. Id. § 638.51.

Plaintiff asserts that Defendant violated § 638.51 by using tracking software that acted as an illegal pen register or trap and trace device. Defendant argues that this claim fails because: (1) § 638.51 only applies to telephone surveillance; and (2) because the software was used with consent. The Court addresses each argument in turn.

1. Telephone Surveillance

Section 638.51 refers broadly to “wire or electronic communication.” However, a related section setting forth requirements for obtaining a court order to install a pen register or trap and trace device, requires an application to specify “[t]he number” and “physical location of the telephone line to which the pen register or trap and trace device is to be attached.” Id. § 638.52(d)(3).

Defendant argues that this language makes clear that § 638.51 applies only to telephone surveillance, not software. Indeed, as Defendant points out, in Rodriguez v. Plivo, Inc., a California Superior Court dismissed a different § 638.51 claim brought by this same Plaintiff on this ground. (Def.’s Request for Judicial Notice, Ex. A at 10, ECF No. 16-1.) However, as this Court explained in Moody v. C2 Educational Systems Inc., § 638.51 and the definitions supplied by § 638.50 are not so limited. 2024 WL 3561367, at *2 (C.D. Cal. July 25, 2024). Section 638.50 simply refers to “device[s] or process[es]” that record or capture certain information from “a wire or electronic communication.” Id. §§ 638.50(b)–(c). At least one district court, Greenley v. Kochava, Inc., has held that this “expansive” language suggests a broad scope. 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023). As Greenley explained, § 638.50’s language “indicates courts should focus less on the form of the data collector and more on the result.” Id. Thus, Greenley concluded that tracking software could plausibly constitute a pen register under §§ 638.50 and 638.51. Id. The fact that a California Superior Court concluded differently, while persuasive, is not binding and does not foreclose the possibility that software may qualify as a pen register or trap and trace device under California law, at least at the pleading stage.

Defendant alternatively argues that § 638.51 should not apply because the software only collects IP addresses, and the collection of IP addresses is necessary for websites to operate. See, e.g., United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (“IP addresses ․ [are] provided to and used by Internet service providers for the specific purpose of directing the routing of information.”). It appears that Defendant is arguing that an exception set forth under § 638.51(b)(1) should apply, which allows the use of pen registers and trap and trace devices “[t]o operate, maintain, and test a wire or electronic communication service.” However, Plaintiff alleges that the software collects not just IP addresses, but also operating system information, browser information, geolocation data, and email addresses, for use by Defendant and third parties. Defendant does not argue that the collection of this additional data is necessary to operate or maintain the Website. Nor does Defendant argue that the collection of any data by a third party is necessary. Thus, this exception does not apply, and § 638.51 plausibly covers the tracking software at issue.

2. Consent

Section 638.51 also includes an exception for the use of pen registers and trap and trace devices “if the consent of the user of that service has been obtained.” Cal. Penal Code § 638.51(b)(5).

Defendant argues that the tracking software falls within this exception. Specifically, Defendant argues that as the Website's operator, Defendant is the “user” of the Website, and it consented to the software's installation. In support of this argument, Defendant argues that the tracking software operates in much the same way as caller ID. With a caller ID system, the recipient of a telephone call captures certain routing information from the caller—typically, the caller's name and phone number. While this information would ordinarily run afoul of § 638.51, courts have consistently found that the consent exception saves the day, as the recipient is the sole user of the caller ID system, and the recipient consented to its installation and use. See, e.g., Sparshott v. Feld Ent., Inc., 311 F.3d 425, 432 (D.C. Cir. 2002).

Here, it does not appear that the Website's tracking software is analogous to a caller ID system. Unlike a caller ID system, which is installed on the call recipient's device, the Website installs the tracking software on the visitor's browser. The software then remains on the visitor's browser unless the visitor decides to delete it. Given the location and degree of control that the visitor has over the software, it only seems natural that the visitor, not Defendant, would be software's user in these circumstances. And according to the plain allegations of the FAC, Plaintiff did not consent to the software's installation and use. Indeed, Plaintiff alleges that the software was installed immediately upon loading the Website before she had any opportunity to consent to Defendant's privacy policy.

Nonetheless, Defendant argues that Plaintiff implicitly consented to the use of the tracking software. As noted above, IP addresses are necessary for basic website operability. Forrester, 512 F.3d at 510. Defendant therefore argues that any reasonably informed visitor would understand that by visiting the Website, or any website for that matter, she was giving her IP address, and therefore implicitly consented to its collection. Defendant's argument misses the mark. As also noted above, Plaintiff alleges that the tracking software captured more than just her IP address. She alleges that the software also captured her operating system information, browser information, geolocation data, and email addresses, and that this information was sent to third parties, not just Defendant. Defendant does not argue that Plaintiff had any reason to expect this information to be captured, be it by Defendant or third parties. Thus, this exception does not apply.

Having found both of Defendant's arguments unconvincing, the Court DENIES Defendant's Motion as to Plaintiff's § 638.51 claim.

V. CONCLUSION

For the foregoing reasons, the Court GRANTS Defendant's Motion to Dismiss in part. The Court DISMISSES Plaintiff's § 631 claim without prejudice. Plaintiff shall file any amended complaint within fourteen (14) days of this Order.

IT IS SO ORDERED.

FOOTNOTES

1.   Though set forth in the penal code, invasions of privacy may also be brought as civil claims. Cal. Penal Code § 637.2.

2.   A tester is an individual that seeks out legal violations and files lawsuits to ensure legal compliance.

3.   To be sure, Defendant includes a copy of the Website's privacy policy in a Request for Judicial Notice. (Def.’s Request for Judicial Notice, Ex. B, ECF No. 16-2.) However, this says nothing of the banner's conspicuousness or contents.

R. GARY KLAUSNER, UNITED STATES DISTRICT JUDGE