Judge: Daniel S. Murphy, Case: 24STCV19034, Date: 2025-03-12 Tentative Ruling

Case Number: 24STCV19034    Hearing Date: March 12, 2025    Dept: 32

BACKGROUND

            On July 30, 2024, Plaintiff Miguel Esparza filed this action against CommonSpirit Health for violations of the California Invasion of Privacy Act (CIPA). Plaintiff filed the operative First Amended Complaint on December 27, 2024, changing the claim to a class action.

            Plaintiff alleges that Defendant utilizes spyware on its website which intercepts search terms entered by visitors to the website. Plaintiff alleges that Defendant aided and abetted third parties in intercepting Plaintiff’s search terms without Plaintiff’s consent or knowledge. The third parties allegedly intercept the searches for non-search related purposes such as targeted advertising. Plaintiff also alleges that Defendant deploys third-party spyware to immediately track user information upon landing on the website.

            On January 27, 2025, Defendant filed the instant demurrer and motion to strike. Plaintiff filed his opposition on February 27, 2025.

LEGAL STANDARD

A demurrer for sufficiency tests whether the complaint states a cause of action. (Hahn v. Mirda (2007) 147 Cal.App.4th 740, 747.) When considering demurrers, courts read the allegations liberally and in context. (Taylor v. City of Los Angeles Dept. of Water and Power (2006) 144 Cal.App.4th 1216, 1228.) In a demurrer proceeding, the defects must be apparent on the face of the pleading or by proper judicial notice. (Code Civ. Proc., § 430.30, subd. (a).) A demurrer tests the pleadings alone and not the evidence or other extrinsic matters. (SKF Farms v. Superior Court (1984) 153 Cal.App.3d 902, 905.) Therefore, it lies only where the defects appear on the face of the pleading or are judicially noticed. (Ibid.) The only issue involved in a demurrer hearing is whether the complaint, as it stands, unconnected with extraneous matters, states a cause of action. (Hahn, supra, 147 Cal.App.4th at 747.)

MEET AND CONFER

Before filing a demurrer or a motion to strike, the demurring or moving party is required to meet and confer with the party who filed the pleading demurred to or the pleading that is subject to the motion to strike for the purposes of determining whether an agreement can be reached through a filing of an amended pleading that would resolve the objections to be raised in the demurrer. (Code Civ. Proc., §§ 430.41, 435.5.)

The Court notes that Defendant has not filed the requisite declaration demonstrating meet and confer. However, Plaintiff does not deny that a meet and confer took place, and inadequate meet and confer is not a reason to overrule a demurrer. Therefore, the Court proceeds on the merits.

DISCUSSION

I. Wiretapping

a. Statutory Framework

            Penal Code section 631(a) proscribes four types of conduct stemming from wiretapping: (1) where a person intentionally taps or makes an unauthorized connection with any telephone wire, line, cable, or instrument; (2) where a person willfully and without consent reads, or attempts to learn, the contents of a communication in transit or passing over any wire, line, or cable, or is being sent from or received at any place within the state; (3) where a person uses, or attempts to use, any information so obtained; and (4) where a person aids, agrees with, employs, or conspires with any person to do any of the acts mentioned above. (Yoon v. Lululemon United States (C.D.Cal. 2021) 549 F.Supp.3d 1073, 1080.)

            Plaintiff alleges that Defendant violated CIPA through the fourth prong, aiding and abetting. (FAC ¶ 85.)

            b. Aiding and Abetting, and the Party Exception

            CIPA contains “an exemption from liability for a person who is a ‘party’ to the communication.” (Davis v. Facebook, Inc. (In re Facebook Inc. Internet Tracking Litig.) (9th Cir. 2020) 956 F.3d 589, 607.) Penal Code section 631 applies “only to eavesdropping by a third party and not to recording by a participant to a conversation.” (Ibid.) “California courts have been instructed to analyze whether the technology (or actor) behaves more akin to a tape recorder utilized by the party to the conversation or as an eavesdropper ‘press[ing] up against a door to listen to a conversation.’” (Licea v. Am. Eagle Outfitters, Inc. (C.D.Cal. 2023) 659 F.Supp.3d 1072, 1082.) In the software context, “[w]hen a party captures and stores data, courts have found that they operate like an extension of the defendant (i.e. a tape recorder).” (Id. at p. 1083.) Thus, the party exception applies where “[t]he alleged use of the data by the third party . . . does not appear to be independent,” and “[t]he pleadings . . . nowhere suggest that the third party has the ability to use the information independently.” (Ibid.)

            The FAC alleges that Defendant’s website uses a search engine developed by a third party. (FAC ¶ 12.) The FAC alleges that Defendant surreptitiously implements this third-party search engine on its website to allow the third party to intercept private search terms. (Id., ¶¶ 14-16.) Defendant allegedly implemented a search bar along with various marketing tools to allow the third party to intercept and read Plaintiff’s search terms. (Id., ¶ 18.) The third-party allegedly uses the intercepted search terms “for its own advertising purposes and does so to benefit its own products and services.” (FAC ¶ 23.) Defendant allegedly programmed its website to surreptitiously transmit Plaintiff’s search terms to the third party. (Id., ¶ 31.)

These facts sufficiently establish that the third party violated the second and third prongs by willfully learning the contents of a communication without consent and using the information so obtained. The facts establish that Defendant violated the fourth prong by aiding and abetting the third party. The facts also establish that the third party utilizes the intercepted information for its own purposes and does not act merely as an extension of Defendant. Therefore, the party exception does not apply.

In sum, the FAC adequately alleges Defendant’s liability for aiding and abetting an unlawful interception.

c. Content of a Communication

Defendant argues that Plaintiff fails to allege the contents of any communication, such as specific sensitive information relayed in the purported searches. However, “pleading a CIPA violation does not require identifying a specific communication that was intercepted.” (Greenley v. Kochava, Inc. (S.D.Cal. 2023) 684 F. Supp. 3d 1024, 1050.) The facts in the FAC support a reasonable inference that a communication was intercepted and that Defendant aided and abetted this interception, which is enough to survive a demurrer under California’s liberal pleading standard.

d. Communication in Transit

Defendant argues that the FAC alleges the recording of a communication and subsequent transmission to a third party, not a real-time interception “in transit.” However, the FAC alleges that Defendant “re-routed” communications meant for Defendant to the third party. (FAC ¶ 26.) The third party allegedly has “immediate access” to the search terms. (Id., ¶ 16.) For pleading purposes, it may be reasonably inferred that this was a real-time interception. Defendant’s factual contention that the communications were recorded and then transmitted goes beyond the four corners of the complaint.  

Moreover, Penal Code section 631(a) is written in the disjunctive. It prohibits the unauthorized reading of a communication “while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.” The alleged communications were “being sent from, or received at any place within this state” regardless of whether they were in transit. “[N]umerous courts within the Ninth Circuit have concluded that Clause Two is rightfully applied to internet communications.” (Garcia v. Yeti Coolers, LLC (C.D.Cal. Sep. 5, 2023, No. 2:23-cv-02643-RGK-RAO) 2023 U.S.Dist.LEXIS 158968, at *8-9.)

Therefore, the FAC adequately pleads an interception.

II. Pen Register

a. Statutory Framework

“‘Pen register’ means a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” (Pen. Code, § 638.50(b).) “‘Trap and trace device’ means a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” (Id., § 638.50(c).)

            “Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.” (Pen. Code, § 638.51(a).) “Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation.” (Pen. Code, § 637.2(a).) 

            b. IP Address

            Defendant argues that it has not installed a pen register as defined by CIPA because the alleged spyware only tracked Plaintiff’s IP address. Defendant argues that IP addresses are not the type of data contemplated in CIPA because they are necessary for basic website functionality.

            However, the FAC does not only allege the collection of IP addresses. For example, the Neustar software allegedly tracks “physical and offline activities,” and “gathers device and browser information, geographic information, referral tracking, and URL tracking.” (FAC ¶¶ 49-50.) Neustar also allegedly “requests, validates, and transmits other identifying information, including a website visitor’s phone numbers and email addresses.” (Id., ¶ 52.) The FAC alleges that Neustar and the other named software constitute “a process to identify the source of electronic communication by capturing incoming electronic impulses and identifying dialing, routing, addressing, and signaling information generated by users.” (Id., ¶ 73.)

            For pleading purposes, Plaintiff has alleged the usage of a “device or process” fitting the definition of a pen register. (See Pen. Code, § 638.50(b).)

            c. Consent

            Defendant argues that Plaintiff consented to the sharing of his IP address by voluntarily visiting the website. However, as discussed above, the FAC alleges more than the collection of an IP address. Plaintiff’s voluntary visit to the website does not establish as a matter of law that Plaintiff consented to the specific data collection at issue. Plaintiff expressly alleges that he did not consent, which must be taken as true on a demurrer. (See FAC ¶ 75.)

III. Punitive Damages

            To recover punitive damages, a plaintiff must “plead and prove a common law tort.” (De Anza Santa Cruz Mobile Estates Homeowners Assn. v. De Anza Santa Cruz Mobile Estates (2001) 94 Cal.App.4th 890, 912.) “A plaintiff who relies solely on a cause of action for a statutory violation may be deemed to have waived punitive damages” because to “recover both punitive damages and statutory penalties . . . would constitute a prohibited double penalty for the same act.” (Id. at pp. 912-13.)

            Plaintiff’s complaint alleges two statutory violations of CIPA and contains no claims based on tort. CIPA provides for statutory penalties and treble damages, which are already punitive in nature. (Pen. Code, § 637.2(a).) Thus, Plaintiff is not entitled to punitive damages.

IV. Attorney’s Fees

“Except as attorney’s fees are specifically provided for by statute, the measure and mode of compensation of attorneys and counselors at law is left to the agreement, express or implied, of the parties . . . .” (Code Civ. Proc., § 1021.) Thus, “[a]ttorney fees are not recoverable unless a fee award is expressly authorized by either statute or the parties’ contract.” (Ilshin Investment Co., Ltd. v. Buena Vista Home Entertainment, Inc. (2011) 195 Cal.App.4th 612, 627.)

Code of Civil Procedure section 1021.5 allows an award of fees to the successful party “in any action which has resulted in the enforcement of an important right affecting the public interest.” “[A]ttorney fees under section 1021.5 may be awarded for consumer class action suits benefiting a large number of people.” (Graham v. DaimlerChrysler Corp. (2004) 34 Cal.4th 553, 578.) This is a class action with allegations demonstrating that it will benefit a large number of people. (See FAC ¶¶ 78-83.) Thus, Plaintiff is entitled to plead attorney’s fees.

CONCLUSION

            Defendant’s demurrer is OVERRULED. Defendant’s motion to strike is GRANTED as to punitive damages without leave to amend and DENIED as to attorney’s fees.