Yockey v. Salesforce, Inc.

Background

Salesforce’s Chat service operates through Salesforce’s servers but is implemented on Rite Aid’s and Kaiser Permanente’s websites. The service routes customers’ chat messages through a Salesforce server, creates transcripts in real time, and includes a feature allowing an agent to see what a customer types before the customer sends it.

The plaintiffs, who used Rite Aid’s and Kaiser Permanente’s websites, brought a proposed class action alleging violations of California’s Invasion of Privacy Act (CIPA), Sections 631 and 632, and Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA). In an earlier order, the court largely rejected Salesforce’s challenges to the CIPA Section 632 and WESCA claims but dismissed the CIPA Section 631 claim because the allegations did not support an inference that Salesforce could use the communications for purposes beyond providing them to the customer websites. The court allowed amendment of that claim.

The second amended complaint added allegations that Salesforce sends Chat communications to its Einstein data intelligence platform and can use them to train artificial-intelligence models, improve or develop its own products and services, and analyze customer-service interactions and data.

Rule 12(b)(6) standard

The court applied the rule requiring dismissal when a complaint lacks a legally recognized theory or enough factual allegations to make the claim plausible. At this stage, the court accepts the complaint’s factual allegations as true and draws reasonable inferences for the plaintiffs.

CIPA Section 631

The court denied Salesforce’s challenge to the amended Section 631 claim for two reasons.

First, the new allegations plausibly showed that Salesforce had the ability to use its records of the interactions for purposes other than furnishing the communications to Rite Aid and Kaiser Permanente. Salesforce conceded that the amended allegations sufficiently alleged this capability.

Second, the court rejected Salesforce’s argument that the communications could not be intercepted while “in transit” because they first reached Salesforce’s server. The court reasoned that Salesforce was not the communications’ intended recipient. The alleged intended recipients were Rite Aid and Kaiser Permanente, or their relevant doctors, pharmacists, or customer-service agents. Because Salesforce allegedly received the messages before or at the same time as those intended recipients, the court found a reasonable inference that Salesforce intercepted them while they were still in transit.

CIPA Section 632

CIPA Section 632 addresses intentionally recording or listening in on confidential communications without the consent of all parties. The court rejected Salesforce’s argument that the communications were not confidential. It relied on its earlier determination that the healthcare context—including communications about prescription history, medical conditions, and insurance information—supported a reasonable expectation of confidentiality. The court stated that nothing in the new motion changed that analysis.

The court also held that the plaintiffs plausibly alleged that Salesforce’s Chat application programming interface software was a “device” under Section 632. Although CIPA does not define that term, the court found persuasive decisions treating software as a device and emphasized CIPA’s broad privacy-protection purpose. The court therefore denied Salesforce’s motion to dismiss the Section 632 claims.

WESCA

Salesforce argued that Plaintiff Yockey impliedly consented to the recording because he knew or should have known that the chat conversation would be recorded. The court explained that implied consent may exist when a person knew or should have known about the recording, but found that the complaint plausibly alleged no notice that Salesforce, an undisclosed third party, would intercept the communications. The court distinguished cases involving messages recorded or received by the intended recipient.

The complaint alleged that recording began when a user accessed or interacted with the Chat feature, before the user consented to a privacy policy or the wiretapping, and that users were not told the communications would be directed to Salesforce rather than only to the website’s customer-service agent. The court denied the motion to dismiss the WESCA claims, stating that the plaintiffs plausibly alleged that they did not consent to interception by an undisclosed third party. It also noted that consent questions could require discovery and development of the factual record.

Geographic scope of the CIPA claims

Salesforce argued that CIPA could not apply to Plaintiff Yockey and non-California members of the proposed nationwide class. In their opposition, the plaintiffs voluntarily withdrew the CIPA Sections 631 and 632 claims on behalf of the nationwide website class without prejudice, while retaining Plaintiff Magpayo’s individual claims and the California website class and Kaiser subclass claims.

The court denied Salesforce’s extraterritoriality argument as to the remaining claims. The complaint defined the California website class as California residents who used Salesforce’s Chat function on any website, and the Kaiser subclass as California residents who used Chat on Kaiser Permanente’s website while in California. The complaint also alleged that each relevant communication was sent from California and received by Salesforce in California. The court found those allegations sufficient at the pleading stage to plausibly allege that the conduct occurred in California.

Disposition

On August 16, 2024, Judge Jon S. Tigar ordered that Salesforce’s motion to dismiss the second amended complaint was denied.