Judge Stephen P. Pfahler, Case Number: 23STCV26148, Date: 2024-03-13 Tentative Ruling

· 1^st Cause of Action: California Invasion of Privacy Act (Penal Code section 638.51)

Plaintiff Jose Licea, a “consumer privacy advocate who works as a ‘tester’ to ensure that companies abide by the privacy obligations imposed by California law” in order to “advance[] important public interests at the risk of vile personal attacks”[1] alleges defendant Hickory Farms, LLC “secretly installs tracking software on the devices of all visitors to its website in violation of California law.” Plaintiff characterizes the technology as a “pen register” and “trap and trace” device.

On October 25 2023, Plaintiff filed a complaint for Comprehensive Computer Data and Access Fraud Act, California Invasion of Privacy Act (Penal Code section 638.51), California Invasion of Privacy Act (Penal Code section 631), Invasion of Privacy, and Intrusion Upon Seclusion. On December 4, 2023, Plaintiff filed a first amended complaint for California Invasion of Privacy Act (Penal Code section 638.51)

The court takes judicial notice of the legislative history. On the other superior court order, and certified copy of the transcript, the court takes notice of the existence of documents, but declines to take notice for the truth of any matter asserted in either item. (Kilroy v. State of California (2004) 119 Cal.App.4th 140, 147-148; Sosinsky v. Grant (1992) 6 Cal.App.4th 1548, 1565.) The order or transcript was never published, and therefore not citable for any reference. (Cal. Rules of Court, rule 8.1115(a); Rittiman v. Public Utilities Com. (2022) 80 Cal.App.5th 1018, 1043 (footnote 18).)

[1]A search of the court index reveals at least 19 filed, pending or dismissed cases under Jose Licea with counsel from Pacific Trial Attorneys, including 23STCV25882, 23STCV28947, 23STCV02906, 23STCV02964, 23STCV14667, 23STCV14680, 23STCV14839, 23STCV26145, 23STCV15816, 23STCV16165, 23STCV16244, 23STCV16259, 24STCV00021, 24STCV01651, 24STCV01653, 24STCV01687, 24STCV02041, and 24STCV 02762. The court presumes counsel presents the allegation of a consumer advocate in order to proactively defend against a potential motion to designate Plaintiff and/or the law firm as vexatious. It remains to be determined whether the serial filing of similar actions will lead to review for coordination, consolidation, or other form of special designation.

The declaration of counsel on the subject matter of sanctions constitutes argument beyond the scope of the demurrer. The court therefore declines to consider the subject matter.

Defendant Hickory Farms, LLC (Hickory Farms) brings the subject demurer to the first amended complaint for California Invasion of Privacy Act under Penal Code section 638.51. Hickory Farms challenges the operative complaint on a lack of sufficient facts to establish liability. Plaintiff Jose Licea in opposition contends the statutory based claim is properly pled. Plaintiff maintains the “pen register” technology used in conjunction with an IP address via mobile phone qualifies as an improper act. Hickory Farms in reply specifically addresses the exclusion/lack of any inclusion of IP address information acquisition as a violation of the California Consumer Privacy Act or the federal Patriot Act.

A demurrer is an objection to a pleading, the grounds for which are apparent from either the face of the complaint or a matter of which the court may take judicial notice. (Code Civ. Proc., § 430.30, subd. (a); see also Blank v. Kirwan (1985) 39 Cal.3d 311, 318.) The purpose of a demurrer is to challenge the sufficiency of a pleading “by raising questions of law.” (Postley v. Harvey (1984) 153 Cal.App.3d 280, 286.) “In the construction of a pleading, for the purpose of determining its effect, its allegations must be liberally construed, with a view to substantial justice between the parties.” (Code Civ. Proc., § 452.) The court “ ‘ “treat[s] the demurrer as admitting all material facts properly pleaded, but not contentions, deductions or conclusions of fact or law . . . .” ’ ” (Berkley v. Dowds (2007) 152 Cal.App.4th 518, 525.) In applying these standards, the court liberally construes the complaint to determine whether a cause of action has been stated. (Picton v. Anderson Union High School Dist. (1996) 50 Cal.App.4th 726, 733.)

“A demurrer for uncertainty is strictly construed, even where a complaint is in some respects uncertain, because ambiguities can be clarified under modern discovery procedures.” (Khoury v. Maly's of California, Inc. (1993) 14 Cal.App.4th 612, 616; Williams v. Beechnut Nutrition Corp. (1986) 185 Cal.App.3d 135, 139 [“[U]nder our liberal pleading rules, where the complaint contains substantive factual allegations sufficiently apprising defendant of the issues it is being asked to meet, a demurrer for uncertainty should be overruled or plaintiff given leave to amend.]

(a) Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.

(b) A provider of electronic or wire communication service may use a pen register or a trap and trace device for any of the following purposes:

(3) To protect users of the service from abuse of service or unlawful use of service.

(4) To record the fact that a wire or electronic communication was initiated or completed to protect the provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful, or abusive use of service.

(c) A violation of this section is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.

(d) A good faith reliance on an order issued pursuant to Section 638.52, or an authorization made pursuant to Section 638.53, is a complete defense to a civil or criminal action brought under this section or under this chapter.

For purposes of the demurrer, Hickory Farms contends the operative complaint fails to allege sufficient facts establishing the actual use of a “pen register’ and “trap and trace device” “within the meaning of” the California Invasion of Privacy Act (CIPA) notwithstanding the admitted allegations in the first amended complaint regarding the use of said technology. [See First Amend. Comp., ¶ 20.] Hickory Farms maintains the subject devices are limited to telephonic devices, including cellular phones, and not via internet connected devices with a unique IP address, as relied upon in the first amended complaint. [See First Amend. Comp., ¶¶ 9-14.]

“(b) ‘Pen register’ means a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication. ...

“(c) ‘Trap and trace device’ means a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.”

The court considers the telephonic functionality represented limitation. CIPA begins with Penal Code section 630, with definitions and limitations reflecting an era of cordless radio phones and cellular phones at the time.

“(a) Every person who, without the consent of all of the parties to a communication, intercepts or receives and intentionally records, or assists in the interception or reception and intentional recordation of, a communication transmitted between two cellular radio telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a cordless telephone and a landline telephone, or a cordless telephone and a cellular radio telephone, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has been convicted previously of a violation of this section or of Section 631, 632, 632.5, 632.6, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment.

(d) As used in this section, each of the following terms have the following meaning:

(1) “Cellular radio telephone” means a wireless telephone authorized by the Federal Communications Commission to operate in the frequency bandwidth reserved for cellular radio telephones.

(2) “Cordless telephone” means a two-way, low power communication system consisting of two parts, a “base” unit which connects to the public switched telephone network and a handset or “remote” unit, that are connected by a radio link and authorized by the Federal Communications Commission to operate in the frequency bandwidths reserved for cordless telephones.

(3) “Communication” includes, but is not limited to, communications transmitted by voice, data, or image, including facsimile.”

Legislative updates and commentary continue to explicitly cover cordless and cellular phone technology without reference to internet based communications. (Smith v. LoanMe, Inc. (2021) 11 Cal.5th 183, 191.) The subject argument has been addressed many times by district courts, including a previously dismissed action by the same Plaintiff and counsel in the Central District. (Licea v. Cinmar, LLC (C.D. Cal. 2023) 659 F.Supp.3d 1096, 1104; see Licea v. Vitacost.com, Inc. (S.D. Cal., July 24, 2023, No. 22-CV-1854-RSH-WVG) 2023 WL 5086893, at *4-5; Augustine v. Lenovo (United States), Inc. (S.D. Cal., Aug. 2, 2023, No. 22-CV-2027-L-AHG) 2023 WL 4938050, at *4; Garcia v. Build.com, Inc. (S.D. Cal., July 13, 2023, No. 22-CV-01985-DMS-KSC) 2023 WL 4535531, at *6; Kauffman v. Papa John's International, Inc. (S.D. Cal., Jan. 12, 2024, No. 22-CV-1492-L-MSB) 2024 WL 171363, at *9.)

A recent district court case however characterizes certain internet based software as equivalent to a pen register, which Plaintiff cites to directly in the operative complaint. [First Amend. Comp., ¶¶ 17, 19.] (Greenley v. Kochava, Inc. (S.D. Cal., July 27, 2023, No. 22-CV-01327-BAS-AHG) 2023 WL 4833466, at *15–16.) Plaintiff conclusively pleads the pen register claim via parroting the relied upon case, to which Defendant challenges as still qualitatively flawed.

The court finds validity in the argument that nothing in the complaint establishes an IP address as equivalent to the “unique fingerprinting” relied upon by the Southern District when finding embedded software into a mobile phone, thereby providing unique location and other information normally within the domain of law enforcement officers with a warrant. (Ibid; Heeger v. Facebook, Inc. (N.D. Cal. 2020) 509 F.Supp.3d 1182, 1190 [“There is no legally protected privacy interest in IP addresses alone”]; In re Facebook, Inc. Internet Tracking Litigation (9th Cir. 2020) 956 F.3d 589, 604; U.S. v. Forrester (9th Cir. 2008) 512 F.3d 500, 510.) The operative complaint otherwise lacks any actually acquired qualifying information for the establishment of a violation. [See First Amend. Comp., ¶¶ 9-14.] “Record information, the Ninth Circuit explained, ‘includes the name, address, and subscriber number or identity of a subscriber or customer.’ (Citation.) ... However, user names, passwords, and geographic location information are not contents. (Citation.)” (Brodsky v. Apple Inc. (N.D. Cal. 2020) 445 F.Supp.3d 110, 127.)

Plaintiff offers no apparent challenge the current interpretation governing state law and instead introduces new argument based on the federal Patriot Act (18 U.S.C. § 3127(3): “the term ‘pen register’ means a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, provided, however, that such information shall not include the contents of any communication, but such term does not include any device or process used by a provider or customer of a wire or electronic communication service for billing, or recording as an incident to billing, for communications services provided by such provider or any device or process used by a provider or customer of a wire communication service for cost accounting or other like purposes in the ordinary course of its business ...”

The court finds no inherent conflict with the standards. The court however finds lacking factual support however under the standard.

First and foremost, the operative complaint only alleges a “device” without any actual specific reference to a mobile phone or other potential form of communication device potentially qualifying as a cellular device. [First Amend. Comp., ¶ 20.] Even assuming a qualifying device was pled, the court agrees with the argument regarding the basis of consent under the guise of visiting a website, where an IP address may be voluntarily disclosed. (Heeger v. Facebook, Inc., supra, 509 F.Supp.3d at p. 1190; U.S. v. Forrester, supra, 512 F.3d at p. 510.) At a minimum, it remains unclear from the conclusively pled complaint how Plaintiff’s information was acquired, including initiation from a visit to the Hickory Farm website, and whether any protocols were violated from said visit. The court declines to characterize the “consent” argument as only available in the form of a defense in that the court cannot determine qualification under CIPA in the first place. (Brown v. Google LLC (N.D. Cal. 2021) 525 F.Supp.3d 1049, 1063.)

The court also finds public policy strongly disputes Plaintiff’s potential interpretation of privacy laws as one rendering every single entity voluntarily visited by a potential plaintiff, thereby providing an IP address for purposes of connecting the website, as a violator. Such a broad based interpretation would potentially disrupt a large swath of internet commerce without further refinement as the precise basis of liability, which the court declines to consider. Hickory Farms in reply also cites to certain defined rights and compliance obligations for data collection via internet connectivity, but the court both finds the argument extrinsic given the paucity of underlying facts in the operative complaint, as well as depriving Plaintiff of an opportunity to respond. (Civ. Code, § 1798.100, et seq.)

Finally, the court also raises potential concern involving the requirement of a third party to actually commit a volitional act for purposes of liability. The conclusive allegations in the first amended complaint in no way indicates any preexisting relationship between the parties (e.g. a customer inquiry), or otherwise specifically articulate Hickory Farms as a third party for purposes of alleging liability. (In re Facebook, Inc. Internet Tracking Litigation (9th Cir. 2020) 956 F.3d 589, 606-608; Brodsky v. Apple Inc., supra, 445 F.Supp.3d at p. 127; see Smith v. LoanMe, Inc. (2021) 11 Cal.5th 183, 193-196.)

The court sustains the demurrer with 30 days leave to amend in order to allow Plaintiff an opportunity to improve the quality of the allegations, rather than concluding an inability to plead a valid claim upon first review. Plaintiff may not add any new causes of action or allegations to the previously existing claims. (Harris v. Wachovia Mortgage, FSB (2010) 185 Cal.App.4th 1018, 1023.) Any new causes of action added without leave of court may be subject to a motion to strike.