Judge David S. Cunningham, Case Number: 25STCV02327, Date: 2025-05-06 Tentative Ruling

Judge: David S. Cunningham, Case: 25STCV02327, Date: 2025-05-06 Tentative Ruling

1. Californians increasingly conduct their lives and activities over the Internet, sharing often sensitive personal information with companies by using company websites rather than landline telephones.

2. Defendant created its own online presence at canalinsurance.com (the “Website”) to communicate with potential customers, encouraging engagement with this electronic medium – Defendant’s Website -- as an alternative to the telephonic or in-person interaction. Defendant did this to enable potential customers to obtain information from and about Defendant’s insurance products, and to enable Defendant to elicit information from potential customers about their specific needs and desires.

3. Defendant well understands that its Website is a means to communicate privately with potential customers – a consumer expectation that is not only reasonable, but actively nurtured by Defendant. Indeed, Defendant assures visitors that “Canal recognizes and shares the privacy concerns of visitors to our Website.” See https://canalinsurance.com/privacy-policy/ (last accessed November 2024).

4. Defendant’s promise is false. In reality, Defendant aids a third party (Meta Systems, Inc., owner of Facebook and Instagram) to surveil every detail of its interactions with visitors to its Website, thereby allowing Meta to create detailed portraits of Website visitors’ interests, needs, and desires and bombard them with advertising.

5. In short, Defendant falsely promised Website visitors that it would protect their privacy, but then secretly monetized their personal information by enabling Meta to spy on those visitors, surveil their journey across the web, track their location and lifestyle habits, and bombard them with targeted advertising. Rather than candidly disclose this arrangement, Defendant explicitly and implicitly assured Website visitors that their identities and privacy would be protected. In short, Defendant lied.

6. Plaintiff visited Defendant’s website several times, most recently in mid-2024. Without Plaintiff’s or class members’ knowledge or consent, Defendant deployed Meta’s de-anonymization process to identify Plaintiff using electronic impulses generated from Plaintiff’s device, as further described herein. Defendant’s installation of the Meta tracing process violates California’s Trap and Trace Law, codified at California Penal Code § 638.51.

Here, Defendant moves to quash service of process for lack of personal jurisdiction.

There are “two types of personal jurisdiction[,]” general and specific. (Bristol-Myers Squibb Co. v. Superior Court of California, San Francisco County (2017) 582 U.S. 255, 262 (“BMS”).)

“A state court may exercise general jurisdiction only when a defendant is ‘essentially at home’ in the State. [Citation.]” (Preciado v. Freightliner Custom Chassis Corp. (2023) 87 Cal.App.5^th 964, 976.) “General jurisdiction, as its name implies, extends to ‘any and all claims’ brought against a defendant. [Citation.]” (Ibid.) “Those claims need not relate to the forum State or the defendant's activity there; they may concern events and conduct anywhere in the world.” (Ibid.) “But that breadth imposes a correlative limit: Only a select ‘set of affiliations with a forum’ will expose a defendant to such sweeping jurisdiction. [Citation.]” (Ibid.) “In what [the Supreme Court] ha[s] called the ‘paradigm’ case, an individual is subject to general jurisdiction in her place of domicile. [Citation.]” (Ibid.) “And the ‘equivalent’ forums for a corporation are its place of incorporation and principal place of business.” (Ibid.)

“When determining whether specific jurisdiction exists, courts consider the ‘relationship among the defendant, the forum, and the litigation.’” (Halyard Health, Inc. v. Kimberly-Clark Corp. (2019) 43 Cal.App.5^th 1062, 1070.) “[C]ourts focus on the nature and quality (not the quantity) of defendant’s activity in the forum state.” (Edmond & Karnow, Cal. Practice Guide: Civ. Procedure Before Trial (The Rutter Group June 2023 Update) ¶ 3:240.) “[S]ingle or occasional acts of the corporate agent in a state” may be adequate as long as the lawsuit relates to the “in-state activity.” (Daimler AG v. Bauman (2014) 571 U.S. 117, 127; see also Edmond & Karnow, supra, at ¶ 3:240.1 [“Provided a ‘substantial connection’ with the forum is created thereby, even a single act may support specific personal jurisdiction over a nonresident.”].)

To exercise specific jurisdiction, a court must find purposeful availment (the defendant made purposeful contacts with the forum), relatedness (the litigation arises from or relates to the defendant’s forum contacts), and reasonableness (the forum’s “assertion” of specific jurisdiction “comport[s] with ‘fair play and substantial justice’”). (Halyard Health, supra, 43 Cal.App.4^th at 1070.)

Plaintiff bears the initial burden to establish general jurisdiction and/or specific jurisdiction. (See Vons Companies, Inc. v. Seabest Foods, Inc. (1996) 14 Cal.4^th 434, 449.)

General jurisdiction is unestablished. Defendant “is incorporated” – and headquartered – in South Carolina[.]” (Motion, pp. 11-12; see also McFadden Decl., ¶ 2.) It is not at home in California.

* the “alleged distribution of [the] data also took place” there (id. at p. 14); and

* Defendant’s website does not target “California residences or businesses.” (Ibid. [claiming “Canal does not sell any products, including insurance policies, through the website and does not distribute products or insurance policies through the website”].)

* “Defendant . . . is licensed to sell insurance in California” (Opposition, p. 1);

* nearly eight percent of Defendant’s “policyholders have a California address” (ibid.)

* Defendant’s website “directs California users to the offices of its California-based agents” (id. at p. 6);

* the website “contains a section dedicated to meeting California privacy law requirements, the ‘Privacy Notice for California Residents’ page” (ibid.; see also id. at p. 7 [asserting that “[t]his section . . . instructs California visitors . . . about the procedure for requesting the disclosure of personal information that the Website collects, the procedure for requesting that such data be deleted, among other matters affecting only California residents”], emphasis in original);

* her data was created in California. (See ibid. [analogizing Briskin v. Shopify Inc. (9^th Cir. Apr. 21, 2025, No. 22-15815) 2025 WL 1154075].)

* the California privacy notice on the website is required by law. (See id. at pp. 13-14.)

The burden to prove purposeful availment and relatedness belongs to Plaintiff. (See Briskin, supra, 2025 WL 1154075, at *7.)

Plaintiff relies on Briskin.[1] There, the Ninth Circuit applied the Calder v. Jones (1984) 465 U.S. 783 effects test to assess purposeful availment. The test is utilized “[f]or claims sounding in tort,” like a privacy violation or a data breach, “[t]o analyze whether the tort was purposefully directed to the forum state[.]” (Ibid.) It “requires that the defendant (1) commit an intentional act, that is (2) expressly aimed at the forum state, and (3) which causes harm that the defendant knows will be suffered in the forum state.” (Ibid.)

Plaintiff’s showing fails. She alleges that she “is a resident and citizen of California.” (Complaint, ¶ 10.) She claims she “accessed [Defendant’s] website” from here. (Motion, p. 8.) She also alleges that “Defendant deployed Meta’s de-anonymization process to identify [her] using electronic impulses generated from [her] device[.]” (Complaint, ¶ 6.) In other words, Plaintiff alleges that “[t]he data originated in California, namely from the captured electronic impulses from [her] device – which was within California at all times.” (Motion, p. 8.) But allegations are not enough. (See In re Automobile Antitrust Cases I & II (2005) 135 Cal.App.4^th 100, 110 [instructing that “[t]he plaintiff must provide affidavits and other authenticated documents in order to demonstrate competent evidence of jurisdictional facts” and that “[a]llegations in an unverified complaint are insufficient to satisfy this burden of proof”].) Plaintiff’s burden is unsatisfied because she failed to submit a declaration, and her attorney is not a witness.

What about the evidence that did get filed? Defendant “is licensed to sell insurance in California[.]” (McFadden Decl., ¶ 4.) Almost eight percent of Defendant’s “policyholders have a California address.” (McFadden Decl., ¶ 4.) When a customer clicks the “FIND AN AGENT” tab on Defendant’s website and enters a California zip code – e.g., 90012 (the Spring Street Courthouse’s zip code) – he or she is directed to a page that lists two California agents. (See https://canalinsurance.com/find-an-agent/; see also Sosa Decl., ¶ 5, Ex. 1; Motion, pp. 1, 6.) The website also includes a privacy-notice tab devoted to California residents. (See https://canalinsurance.com/privacy-notice-for-california-residents/; see also Sosa Decl., ¶ 6, Ex. 2; Motion, pp. 6-7.) Although these facts tend to show some California business activities, they do not suffice to pass the Calder effects test and to satisfy Plaintiff’s burden. The gravamen of the case is invasion of privacy. The intentional acts and harms at issue involve nonconsensual surveillance and data collection, not general insurance sales.

The same analysis applies to the relatedness prong. Plaintiff’s showing is inadequate.

However, the Court intends to continue the hearing to give Plaintiff an opportunity to supplement the record (permitting jurisdictional discovery may be appropriate).

Last point. Defendant’s burden to show that it would be unreasonable to exercise jurisdiction does not apply unless and until Plaintiff proves the first two prongs.[2]

[1] The Court views Briskin as persuasive authority.

[2] Defendant cites Heiting v. Marriott International, Inc. (C.D. Cal. 2024) 743 F.Supp.3d 1163. (See Motion, pp. 14-15.) Since the hearing is being continued, the Court declines to address Heiting at this point.

The Court has considered the arguments presented in connection with Defendant Canal Insurance Co.'s motion to quash service of process.

IT IS HEREBY ORDERED that the hearing on Defendant's motion to quash service of process is CONTINUED.

On a motion to quash challenging personal jurisdiction, the plaintiff bears the burden of proving, by a preponderance of the evidence, the facts necessary to establish jurisdiction. [(ViaView, Inc. v. Retzlaff, (2016) 1 Cal. App. 5th 198, 209–10 (“On a challenge to personal jurisdiction by a motion to quash, the plaintiff has the burden of proving, by a preponderance of the evidence, the factual bases justifying the exercise of jurisdiction.”).] This burden requires the plaintiff to provide affidavits and other authenticated documents to demonstrate competent evidence of jurisdictional facts, as allegations alone in an unverified complaint are insufficient to satisfy this burden. (See In re Automobile Antitrust Cases I & II (2005) 135 Cal.App.4^th 100, 110 [instructing that “[t]he plaintiff must provide affidavits and other authenticated documents in order to demonstrate competent evidence of jurisdictional facts” and that “[a]llegations in an unverified complaint are insufficient to satisfy this burden of proof”].) Plaintiff’s burden is unsatisfied because she failed to submit a declaration, and her attorney is not a witness.

In the instant case, Plaintiff alleged she is a California resident who accessed Defendant's website from California, and that data originated from her device within California. However, Plaintiff failed to submit a declaration or other competent evidence to prove these jurisdictional facts. Her attorney's statements are not evidence as the attorney is not a witness to these facts.

The evidence that was filed, such as Defendant being licensed to sell insurance in California, having nearly 8% of policyholders with a California address, the website directing users to California agents, and the website including a California-specific privacy notice, although tending to show "some California business activities", were found insufficient to pass the Calder effects test for the specific claims in this lawsuit. (See Calder v. Jones, 465 U.S. 783, 104 S.Ct. 1482 (1984).) The gravamen of this case is invasion of privacy involving nonconsensual surveillance and data collection, not general insurance sales or legally required privacy notices. Plaintiff's showing was also found inadequate regarding the relatedness prong.

Because Plaintiff has failed to meet her burden of proving the necessary jurisdictional facts with competent evidence, the hearing is continued to allow Plaintiff the opportunity to supplement the record. Jurisdictional discovery might be appropriate in this matter. The burden on Defendant to show that the exercise of jurisdiction would be unreasonable does not apply unless and until Plaintiff proves the first two prongs of the specific jurisdiction test: purposeful availment and relatedness.

The Court will treat Briskin v. Shopify Inc., et al. (9th Cir. 2024) (2025 WL 1154075) as persuasive authority. Given the continuance, the court does not need to address Heiting v. Marriott International, Inc., 743 F. Supp. 3d 1163, 1167 (C.D. Cal. 2024), at this point.

DATED: ______________________________________________ THE HONORABLE DAVID S. CUNNINGHAM III