Judge Kerry Bensinger, Case Number: 24STCV14641, Date: 2024-11-06 Tentative Ruling

RESPONDING PARTY: Plaintiffs Sonya Valenzuela, Jose Jesus Licea, and Miguel Licea

Plaintiffs Sonya Valenzuela, Jose Jesus Licea, and Miguel Licea (collectively, Plaintiffs) brings this action against defendant Patagonia, Inc. d/b/a Patagonia.com (Defendant) for violations of the California Invasion of Privacy Act (CIPA), Cal. Penal Code § 631. Plaintiffs allege that Defendant secretly allow a third-party spyware company to eavesdrop on the private conversations of everyone who communicates through the chat feature at www.patagonia.com.

A demurrer for sufficiency tests whether the complaint states a cause of action. (Hahn v. Mirda (2007) 147 Cal.App.4th 740, 747.) When considering demurrers, courts read the allegations liberally and in context. In a demurrer proceeding, the defects must be apparent on the face of the pleading or via proper judicial notice. (Donabedian v. Mercury Ins. Co. (2004) 116 Cal.App.4th 968, 994.) “A demurrer tests the pleadings alone and not the evidence or other extrinsic matters. …. The only issue involved in a demurrer hearing is whether the complaint, as it stands, unconnected with extraneous matters, states a cause of action.” (Hahn, 147 Cal.App.4th at p. 747.)

Plaintiff requests judicial notice of 16 documents. The request is GRANTED. However, the court does not take judicial notice of the truth of the matters within the documents. (See C.R. Tenet Healthcare Corp. (2009) 169 Cal.App.4th 1094, 110.)

Defendant demurs on the grounds Plaintiffs fail to allege a violation of Penal Code section 631(a)’s first, second, or third clauses. Plaintiffs argue the Complaint adequately alleges violations of the second and third clauses. The Complaint expressly alleges only a violation of the third clause. (Complaint, ¶ 28.) Because a violation of the third clause is contingent upon a finding of a violation of the first or second clause, the court examines whether Plaintiffs sufficiently allege a violation of the second clause. (See Swarts v. Home Depot, Inc. (N.D. Cal. 2023) 689 F.Supp.3d 732, 744 citing Martin v. Sephora USA, Inc. (E.D. Cal. Mar. 30, 2023) No. 1:22-cv-01355-JLT-SAB, 2023 WL 2717636, at *11 [“A violation under the third clause of § 631(a) is contingent upon a finding of a violation of the first or second clause of § 631(a).”].)

Penal Code section 631 subdivision (a) provides, in full, as follows: “Any person who, by means of any machine, instrument, or contrivance, or in any other manner, [1] intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire,

line, cable, or instrument of any internal telephonic communication system, or who [2] willfully

and without the consent of all parties to the communication, or in any unauthorized manner,

reads, or attempts to read, or to learn the contents or meaning of any message, report, or

communication while the same is in transit or passing over any wire, line, or cable, or is being

sent from, or received at any place within this state; or who [3] uses, or attempts to use, in any

manner, or for any purpose, or to communicate in any way, any information so obtained, or who [4] aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or

permit, or cause to be done any of the acts or things mentioned above in this section, is

punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by

imprisonment in the county jail not exceeding one year, or by imprisonment pursuant to

subdivision (h) of Section 1170, or by both a fine and imprisonment in the county jail or pursuant to subdivision (h) of Section 1170.”

The second clause of Section 631(a) prohibits “[a]ny person who, by means of any machine, instrument, or contrivance, or in any other manner … willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.”

Defendant’s demur to the alleged violation of the second clause because (1) the contents of the communications are not specifically identified, (2) Plaintiffs fail to allege that the Third-Party intercepted the communications while in transit or that they originated from or were received within California, (3) Plaintiffs fail to allege that the Third-Party read or attempted to read the message, and (4) the party exception applies. For the reasons set forth below, the court overrules the demurrer.

“[P]leading a CIPA violation does not require identifying a specific communication that was intercepted.” (Greenley v. Kochava, Inc. (S.D. Cal. 2023) 684 F.Supp.3d 1024, 1050-52.) “The analysis for a violation of CIPA is the same as that under the federal Wiretap Act. The Ninth Circuit has held that “contents” under the Wiretap Act “refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication. Record information includes, among other things, the ‘name,’ ‘address,’ and ‘subscriber number or identity’ of ‘a subscriber to or customer of such service.” (D'Angelo v. FCA US, LLC (S.D. Cal. Mar. 28, 2024) No. 3:23-CV-00982-WQH-MMP, 2024 WL 1625771, at *12 (cleaned up).)

Here, the Complaint alleges “whenever a consumer chats via Defendant’s Website, the chat is routed through The Third Party’s servers so they may simultaneously collect a transcript of that chat, along with other user data, in realtime and save it for later access.” (Complaint ¶ 10.) This is sufficient to withstand demurrer. (See D’Angelo, 2024 WL 1625771 at *12 [“Here, the Complaint alleges that Plaintiffs used the “chat feature” of the Website to exchange “chat messages” with Defendant's representatives, which were “recorded” and “transcribed” by Salesforce in “real time,” and that Salesforce read or attempted to read or learn the meaning of their “chat conversations.” (ECF No. 1 ¶¶ 12, 14, 21, 23, 25–26.) These allegations, when accepted as true, support a plausible inference that Salesforce recorded Plaintiffs’ chat messages, which qualify as the “contents” of a communication under § 631(a).”].) The CIPA claim does not fail on these grounds.

The Complaint alleges that Defendant’s chat provider uses “automatic routing software that automatically acquires and transmits user chat communications without any active input from either Defendant’s employees, agents, or human representatives. The Third Party acquires Website visitors’ chat communications by first having its software route them to The Third Party’s own computer servers that it owns, controls, and maintains. The secret code enables and allows The Third Party to secretly intercept in real time, eavesdrop upon, and store transcripts of consumers’ chat communications they think they are having with Defendant, even when such conversations are private and contain personally identifiable information (“PII”) – as Plaintiffs’ did. Defendant neither informs visitors of this conduct nor obtains their consent to these intrusions.” (Complaint, ¶ 11.) These allegations mirror allegations which were found to satisfy the “in transit” requirement. (See, e.g., Heiting v. Taro Pharms. USA, Inc. (C.D. Cal. July 31, 2024) No. 2:23-CV-08002-SPG-E, 2024 WL 3738055, at *4 [“In the SAC, Plaintiff has plausibly alleged that Genesys intercepted her communication while the communication was in transit. Though Plaintiff again realleges that Defendant embeds Genesys's webpage on the webpage the consumer sees (proactive.com) by using an “iFrame” code, Plaintiff now explains that the iFrame setup means that “at the same time Plaintiff sends [a communication] to Defendant,” the communication is “first transmitted to Genesys's servers” before the communications are sent to Defendant. See (SAC ¶¶ 14, 26). The SAC also newly asserts that the Genesys Chat API permits communications, such as Plaintiff's chat communications, to be “transmitted to Genesys in real time.”]; Valenzuela v. Kroger Co. (C.D. Cal. Mar. 28, 2024) No. CV 22-6382-DMG (AGRX), 2024 WL 1336959, at *2 consumer chats are intercepted when they are “routed through Emplifi's Astute Bot servers so they may simultaneously collect a transcript of that chat, along with other user data, in real time and save it for later access[.]”].)

Additionally, the Plaintiffs sufficiently allege that the communications originated in California. The Complaint alleges, “Plaintiffs are residents and citizens of California. While physically within California within the statute of limitations period, Plaintiffs visited Defendant’s website and conducted brief conversations through the website chat feature. Plaintiffs were not advised that the chat was monitored, intercepted, or recorded.” (Complaint, ¶ 4.) The Complaint adequately pleads that the chat communications were intercepted while in transit and that they originated from California. The CIPA claim does not fail on these grounds.

3. “Reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication”

Defendant argues there are no allegations showing that the Third Party read or attempted to read Plaintiffs’ chat communications. The argument is unavailing. A violation of the second clause may be predicated on a third parties’ attempt to learn the contents of the communication. Here, the Complaint alleges, “The Third Party does more than merely provide a storage function for Website users’ chat communications with Defendant. It is more than the proverbial “tape-recorder” in the hand of Defendant. Instead, The Third Party uses its record of Website users’ interaction with Defendant’s chat feature for data analytics and marketing/advertising to consumers – indeed, that is why Defendant pays The Third Party for its software.” (Complaint, ¶ 18.) The finder of fact could reasonably infer from this allegation that the chat provider, in using the record for data analytics and marketing/advertising, learned the contents of Plaintiffs’ communications. The CIPA claim does not fail on these grounds.

To determine whether the party exception applies, the court must first determine whether the pleadings identify the third-party company as an extension of Defendant. “[W]hether software providers … are third parties under California’s eavesdropping statute, or mere tools used by websites, goes to the heart of the privacy concerns articulated in Section 631 and California cases interpreting it.” (Javier v. Assurance IQ, LLC (N.D. Cal. 2023) 649 F. Supp. 3d 891, 897.) The question is whether the third party is being used more like a tape recorder used by one party (deemed not to be eavesdropping) or a friend listening in on another extension (deemed to be eavesdropping prohibited by the act). (Id. at p. 900.)

Here, the Complaint alleges a third-party chat provider used the information gathered from Defendant’s chat communications in a manner that did not simply record the interactions for Defendant’s use. Specifically, the Complaint alleges that the third party company uses the information for data analytics and marketing/advertising to consumers. (See Complaint, ¶ 18.) Accordingly, the third party acted more like an eavesdropper and not like a tape recorder. The party exception fails.

Defendant is ordered to serve and file their answer within 10 days of this order.

Kerry Bensinger

Judge of the Superior Court