Wiley v. Universal Music Group

Background

Christine Wiley and Vishal Shah alleged that Universal Music Group, Inc. (UMG) placed third-party cookies and other tracking technology on their devices even after they selected “Decline All” or otherwise opted out of UMG’s “Online Advertising” and “Performance and Analytics” cookies. They alleged that the tracking allowed third parties to collect information such as browsing history, website interactions, user input, interests, shopping behavior, device information, referring URLs, user identifiers, and possible location data.

The plaintiffs brought claims for invasion of privacy, intrusion upon seclusion, wiretapping and pen-register violations under the California Invasion of Privacy Act (CIPA), common-law fraud or misrepresentation, unjust enrichment, breach of contract, breach of the implied covenant of good faith and fair dealing, and trespass to chattels. They also proposed a class of people in California who browsed UMG websites after declining cookies. UMG moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal for failure to state a legally sufficient claim, and moved to strike allegations and the proposed class definition.

Analysis

The court rejected UMG’s statute-of-limitations argument as to Wiley’s privacy, intrusion, wiretapping, and pen-register claims. Although Wiley did not provide specific visit dates, she alleged that she visited UMG websites on multiple occasions during the four years before filing suit. Because that period could include visits within the applicable one- and two-year limitations periods, the complaint did not conclusively establish untimeliness.

The court held that the privacy and intrusion claims were adequately pleaded. UMG’s cookie notices allegedly represented that users could disable the relevant tracking. In the court’s view, those representations, together with California’s privacy law and related expectations, plausibly supported a reasonable expectation of privacy. The alleged deception and collection of the identified categories of information also prevented the court from deciding at the pleading stage that the conduct could not be highly offensive. The court therefore denied dismissal of the invasion-of-privacy and intrusion-upon-seclusion claims.

The wiretapping claim was dismissed because the plaintiffs did not specifically allege that third parties intercepted communications made by Wiley or Shah. The complaint alleged website visits and tracking but did not identify communications whose contents could have been intercepted. The dismissal was with leave to amend.

The court rejected UMG’s argument that California’s pen-register statute applies only to telephones. It concluded that the statute’s definition is broad enough to cover an online device or process. But the plaintiffs still had not alleged that they communicated with UMG’s websites or identified the dialing, routing, addressing, or signaling information connected to those communications. The pen-register claim was therefore dismissed with leave to amend.

The common-law fraud, deceit, or misrepresentation claim was dismissed with leave to amend because the plaintiffs did not plead the timing of the alleged misconduct with the particularity required by Federal Rule of Civil Procedure 9(b). Their allegations did not identify when they visited the websites, what cookie representations appeared on those dates, or how UMG used the cookies then.

The court denied dismissal of the unjust-enrichment claim. It treated the claim as one seeking restitution rather than as an independent cause of action and concluded that the plaintiffs plausibly alleged that UMG obtained valuable data after misleading them about the effect of their cookie choices.

The breach-of-contract claim was dismissed with leave to amend because the plaintiffs did not plausibly allege a bargained-for exchange. The court found that they alleged a preference for less tracking, but not that they bargained for that result or that any benefit they provided induced UMG’s promise. Because no contract was adequately alleged, the implied-covenant claim was also dismissed with leave to amend.

The trespass-to-chattels claim was dismissed with leave to amend. The plaintiffs did not plausibly allege a measurable loss, physical harm, functional harm, or disruption to their devices from the placement of cookies.

Motion to Strike and Disposition

The court denied UMG’s motion to strike in its entirety. It found that the screenshots and list of UMG websites were not plainly irrelevant or improper at the pleading stage. The court also concluded that the alleged defects in the proposed class definition were not sufficiently clear from the complaint to justify striking the class allegations at that point.

Judge P. Casey Pitts ordered that UMG’s motion to dismiss be denied in part and granted in part. Dismissal was denied for the invasion-of-privacy, intrusion-upon-seclusion, and unjust-enrichment claims. Dismissal was granted with leave to amend for the CIPA wiretapping and pen-register claims, common-law fraud claim, breach-of-contract claim, implied-covenant claim, and trespass-to-chattels claim. Plaintiffs were given 28 days to amend. If they do not file an amended complaint, the claims dismissed in the order will be dismissed with prejudice. UMG’s motion to strike was denied.