ALYSSA GARY MARLA DEFOORT v. DYNATRACE INC DYNATRACE LLC (2024)

MEMORANDUM AND ORDER ON DEFENDANTS’ MOTION TO DISMISS PLAINTIFFS’ FIRST AMENDED CLASS ACTION COMPLAINT (Dkt. No. 21)

I. Introduction

Invoking this court's subject matter jurisdiction over large class actions, Plaintiffs, Alyssa Gary and Marla Defoort, acting on behalf of themselves and a large class of consumers from Massachusetts and California, bring this suit against Defendants, Dynatrace, Inc. and Dynatrace, LLC (collectively Dynatrace).¹ U.S.C. § 1332(d)(2); Fed. R. Civ. P. 23. They allege software tools developed by Defendants violate Massachusetts and California privacy and wiretapping laws. Specifically, Plaintiffs assert Defendants’ software tools captured personal data about them, without their knowledge or consent, when they accessed a website operated by a non-party.

Defendants have asked this court to dismiss Plaintiffs’ First Amended Class Action Complaint (Dkt. No. 18) under Fed. R. Civ. P. 12(b)(1) because the court lacks subject matter jurisdiction and under Fed. R. Civ. P. 12(b)(6) because Plaintiffs’ factual allegations fail to state a claim upon which relief can be granted. As Defendants assert only a facial challenge to this court's subject-matter jurisdiction, the court accepts the truth of the well-pleaded allegations in the complaint when assessing Defendants’ motion, but does not credit conclusory statements. Torres-Negrón v. J & N Records, LLC, 504 F.3d 151, 162 (1st Cir. 2007) (explaining that a court must take the allegations in a plaintiff's complaint as true when resolving a facial challenge under Rule 12(b)(1)); Cheng v. Neumann, 51 F.4th 438, 443 (1st Cir. 2022) (stating the familiar standard for evaluating a motion to dismiss under Rule 12(b)(6), which requires courts to accept well-pleaded allegations and draw all reasonable inferences in the plaintiff's favor, but “not credit legal labels or conclusory statements”). The court grants Defendants’ motion for the reasons that follow.

II. Background

Dynatrace is a technology company that develops and sells software tools to help clients monitor and analyze the ways visitors interact with clients’ websites. One of the features Dynatrace offers its clients is known as “Session Replay.” Clients enable Session Replay by adding code to their websites. When a visitor accesses the client's website, the embedded code retrieves and executes a larger set of code hosted on Dynatrace servers. When the code is executed the visitor's activity on the website is recorded on the visitor's own device and then the transmitted to Dynatrace servers. The information includes the visitor's keystrokes, mouse clicks, data entry, and other electronic communications sent by the user to the website, as well as the user's IP address, geolocation data, and information about the device used to access the website. Dynatrace processes and stores the data. Clients and Dynatrace can later access this information, sort it, and analyze it in various ways. They can also play visually accurate “videos” of each visitor's activities.

In December 2022, Gary, who is a Massachusetts resident and was physically located in Massachusetts, and Defoort, who is a California resident and was physically located in California, both accessed Ulta.com, an e-commerce website operated by a non-party client of Dynatrace. The operator of Ulta.com had added Dynatrace code to its website and as soon as Plaintiffs accessed Ulta.com, Dynatrace servers began receiving information about Plaintiffs’ visits to Ulta.com. This information included Plaintiffs’ IP addresses; geolocation information; information about the manufacturer, operating system, and resolution of the devices they used to access Ulta.com; and Plaintiffs’ mouse clicks and keystrokes as they navigated Ulta.com. Plaintiffs were not notified or given an opportunity to consent before their activities were logged and transmitted to Dynatrace. The nature of their activities appears limited; although Plaintiffs allege that they visited Ulta.com to purchase cosmetics, they have not alleged that they logged into an account or made any purchases during their visit.

III. Discussion

Since federal courts are courts of limited jurisdiction and this court must be assured of its jurisdiction before reaching the merits of Plaintiffs’ claims, the court turns first to Defendants’ argument that it lacks subject matter jurisdiction because Plaintiffs do not have standing. Dantzler, Inc. v. Empresas Berríos Inventory & Operations, Inc., 958 F.3d 38, 46 (1st Cir. 2020). This court's “judicial power is limited by Article III of the Constitution to actual cases and controversies” involving plaintiffs who have standing to sue. Kerin v. Titeflex Corp., 770 F.3d 978, 981 (1st Cir. 2014). Although Defendants are the moving party, Plaintiffs, “as the party invoking federal jurisdiction,” bear the burden of establishing standing to bring their claims in this court. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To meet this burden “at the pleading stage, the plaintiff must ‘clearly ․ allege facts demonstrating’ each element” required to establish the court's subject-matter jurisdiction. Id. (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)).

“In a class action, ‘federal courts lack jurisdiction if no named plaintiff has standing.’ ” Brito v. Garland, 22 F.4th 240, 252 (1st Cir. 2021) (quoting Frank v. Gaos, 586 U.S. 485, 492 (2019)). “To establish standing, a named plaintiff must ‘clearly ․ allege facts demonstrating’ that she ‘(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.’ ” Id. (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016)). Defendants contend that Plaintiffs have failed to plead facts sufficient to establish that they have suffered an injury in fact.

“For an injury in fact to be plausibly pled, it ‘must be both concrete and particularized and actual or imminent, not conjectural or hypothetical.’ ” DiCroce v. McNeil Nutritionals, LLC, 82 F.4th 35, 39 (1st Cir. 2023) (quoting Hochendoner v. Genzyme Corp., 823 F.3d 724, 731 (1st Cir. 2016)). Plaintiffs who allege an injury resulting from a violation of a statutory right do not “automatically satisf[y] the injury-in-fact requirement.” TransUnion LLC v. Ramirez, 594 U.S. 413, 426 (2021) (internal quotations omitted). “Only those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” Id. at 427 (emphasis in original).

“A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Spokeo, 578 U.S. at 340. Traditional tangible harms, like physical or financial injuries, “readily qualify as concrete injuries under Article III.” TransUnion, 594 U.S. at 425. “[I]ntangible harms can also be concrete,” as when an injury has “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” Id. Harms need not be identical to have a “close relationship,” but similar types of harm must flow from analogous conduct. Id. at 433. Additionally, “legislatures ‘can raise to the status of legally cognizable injuries certain harms that might otherwise have been insufficient at common law,’ ” but they “can't spin ‘a bare procedural violation, divorced from any concrete harm’ into an ‘injury-in-fact.’ ” Amrhein v. eClinical Works, LLC, 954 F.3d 328, 331 (quoting Katz v. Pershing, LLC, 672 F.3d 64, 75 (1st Cir. 2012); Spokeo, 578 U.S. at 341)); see also Gaos, 586 U.S. at 493 (remanding appeal of order approving settlement for post-Spokeo standing analysis in case alleging statutory violations by internet search operator that shared users’ internet searches with websites accessed by those users).

The Supreme Court has previously recognized that intangible harms stemming from disclosure of private information and intrusion upon seclusion are sufficiently concrete for purposes of Article III standing, TransUnion, 594 U.S. at 425, and lower courts have found such harms in cases alleging a defendant's internet tacking activities violated federal or state statutes. Citing several of these cases, Plaintiffs argue Defendants’ collection of information about their activities at Ulta.com and the technology they used to access Ulta.com caused a concrete injury for purposes of Article III. Defendants contend Plaintiffs’ factual allegations in this case are distinguishable and fall short of alleging the types of privacy violations that are also concrete injuries.

Plaintiffs have alleged Defendants created a product that gathers data about the activities of visitors to a website—information about the devices used to access the website, as well as mouse clicks, keystrokes, and other electronic communications made while the visitor accesses the website. Defendants sold the Session Replay product to clients who operate websites, one of whom is Ulta.com. Clients, including Ulta.com, added Defendants’ code to their own websites to access Defendants’ Session Replay feature. Ulta.com, as well as other clients, did not expressly notify visitors to their websites that the Defendants’ Session Replay tool would capture and retain information about their interaction with the websites. The information was transmitted to Dynatrace servers. Defendants and the website owner could access the information in several ways, including by watching a video-quality simulation of an individual user's visit to the website.

Plaintiffs each accessed the Ulta.com website; their activities were captured by Defendants’ Session Replay technology and sent to Defendants’ servers. Though the Complaint includes a description of how Defendants’ Session Replay technology could be used to gather various types of sensitive information entered by website visitors, such as usernames, passwords, or payment details, neither Plaintiff has alleged she entered that type of information during her visit to Ulta.com. Similarly, Plaintiffs have generally alleged that Defendants could combine website visitor information obtained from multiple clients to create profiles of a single user's activities across websites, but neither has alleged accessing any other websites that utilize Defendants’ Session Replay technology. Additionally, even if Defendants could derive additional commercial benefit from their Session Replay technology by selling the data they gather, Plaintiffs have not alleged their data was shared beyond Dynatrace and Ulta.com.

These allegations fall short of the types of internet tracking activity which other courts have found sufficient to establish a concrete injury either because there was a disclosure of private information or an intrusion on users’ seclusion. For example, the Third Circuit found internet users suffered a concrete injury when a defendant, who had publicly promised not to track users’ browsing activity, proceeded to do so anyway, and then paired the browsing information from multiple websites with user account data and shared the information in order to generate revenue by serving users targeted advertising. In re Google Inc. Cookie Placement Consumer Privacy Litig., 934 F.3d 316, 325 (3d Cir. 2019); In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 272-73 (3d Cir. 2016). The collection of browsing activity from across multiple websites, especially following promises that there would not be tracking, and the pairing of such information with user account data both intrudes on the users’ expectations of privacy and creates a body of personal information which gets shared when it is used to serve targeted advertising to users.

Similar conduct involving a social media company tracking of users’ browsing activity, even after they logged out, as they visited unrelated websites across the internet, pairing the browsing histories with information in the users’ social media profiles, and then monetizing the vast body of personal data by selling it to advertisers was recognized by the Ninth Circuit as sufficient to cause concrete injuries. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598-99 (9th Cir. 2020). Closer to home, a court in this district found a concrete injury where a defendant bundled data about the cooking videos the plaintiff watched at the website with personal identifying information she provided to create an account with the website and then sold that data to advertisers. Adams v. America's Test Kitchen, LP, 680 F. Supp. 3d 31, 40-41 (D. Mass. June 30, 2023).

In contrast, here Plaintiffs have not alleged that Defendants sold Plaintiffs’ browsing data to advertisers; collected any private data, like usernames, passwords, or payment information; tracked Plaintiffs’ browsing beyond Ulta.com; or paired browsing data with personal data contained in a user account. Plaintiffs have not alleged that any parties other than Ulta.com and Dynatrace had access to the data about their visit to Ulta.com or that their data was likely to be used in a manner that would alter their experience accessing other websites. Additionally, Defendants were acting on behalf of Ulta.com and collected only information freely provided by visitors to Ulta.com. As a practical matter, their role was akin to a market research firm hired by a retailer to gather information by observing customers as they shop in a space controlled by the retailer. See e.g., Cook. v. GameStop, Inc., 689 F. Supp. 3d 58, 66 (W.D. Pa. 2023) (explaining that “[p]roduct preference information is not personal information” because it “is no different from what [the defendant's] employees would have been able to observe if [the plaintiff] had gone into a brick-and-mortar store” and consumers do not have a reasonable expectation in such shopping behavior, whether in the physical or digital world). In such circumstances, Plaintiffs do not have a reasonable expectation of privacy in the collection of anonymized data within a digital space on behalf of the operator of that space and they have not suffered the type of concrete injury necessary to establish Article III standing.

IV. Conclusion

For the reasons discussed above, Defendants’ Motion to Dismiss (Dkt. No. 21) is ALLOWED as to all counts. This case may now be closed.

It is so Ordered.

FOOTNOTES

1.   Defendants object to being treated as a single entity, asserting that Dynatrace, Inc. is solely a holding company and is not liable for actions taken by Dynatrace, LLC. However, at this stage of the litigation, the court must credit Plaintiffs’ factual allegation that Defendants “are in all relevant respects essentially the same company, and acted jointly with respect to all the conduct alleged” by Plaintiffs. (Dkt. No. 18, ¶ 3.)

MARK G. MASTROIANNI United States District Judge