Graham v. Noom, Inc.

Background

Audra Graham and Stacy Moise brought the case individually and on behalf of a proposed class of California residents who visited Noom.com and whose electronic communications were intercepted or recorded by FullStory. Noom operates a web application intended to help users lose weight and live healthier lifestyles. FullStory provides Noom with session-replay software that records information such as keystrokes, mouse clicks, page scrolling, visit dates and times, Internet Protocol addresses, locations, browser types, operating systems, and information entered into Noom forms. The plaintiffs alleged that this software captured personally identifiable information and protected health information without their consent.

The amended complaint asserted three claims: wiretapping under California Penal Code § 631(a); selling or providing eavesdropping software under California Penal Code § 635(a); and invasion of privacy under the California Constitution. Noom and FullStory moved to dismiss. Noom also challenged the plaintiffs’ standing to seek injunctive relief, and FullStory challenged the court’s personal jurisdiction over it.

Section 631(a) wiretapping claim

The court explained that California’s wiretapping law imposes liability for secretly listening to another person’s communication, but only a third party can secretly eavesdrop. A party to the communication may record it without eavesdropping under the authorities discussed by the court.

The plaintiffs argued that FullStory was a third-party eavesdropper and that Noom aided and abetted FullStory’s conduct. The court distinguished cases involving companies that independently intercepted data from other websites, mined it, or sold it. Here, the complaint alleged that FullStory was Noom’s vendor: it captured Noom’s data, stored it on FullStory’s servers, and allowed Noom to analyze that data. The court characterized FullStory as an extension of Noom and as providing a tool that allowed Noom to record and analyze its own data. Because the complaint did not plausibly allege that FullStory was a third-party eavesdropper, the court concluded that there was no wiretapping and no underlying wrongdoing for Noom to aid and abet.

The court also addressed the plaintiffs’ reliance on information such as Internet Protocol addresses, locations, browser types, and operating systems. The plaintiffs did not dispute that this information was not the content of a communication. The court dismissed the claim to the extent it relied on non-content information, while stating that an amended complaint could distinguish content from non-content records.

FullStory separately argued that Noom’s privacy policy disclosed the data collection. The court did not resolve that issue. Because it held that the complaint did not plausibly allege wiretapping, the parties’ arguments about consent and the adequacy of the privacy-policy disclosures were moot, and the privacy policy was not a separate ground for dismissal on that round of motions.

The court dismissed the section 631(a) claim with leave to amend.

Section 635(a) eavesdropping-software claim

The plaintiffs alleged that FullStory’s software violated California Penal Code § 635(a), which addresses devices designed or intended for eavesdropping. The defendants argued that the plaintiffs lacked an injury and therefore lacked both a private right of action under the statute and constitutional standing. They also argued that FullStory’s code was not a device primarily or exclusively designed for eavesdropping.

The court held that because the complaint did not plausibly allege eavesdropping, it did not allege a violation of California’s privacy law. The plaintiffs therefore suffered no injury under the court’s analysis and lacked a private right of action and constitutional standing for this claim. Because of that conclusion, the court did not further address whether the session-replay code was a device designed primarily or exclusively for eavesdropping.

California constitutional privacy claim

The plaintiffs alleged that Noom and FullStory intentionally invaded their privacy by implementing FullStory’s wiretapping on Noom’s website. The court held that, because the complaint did not plausibly allege a wiretap by FullStory, it also did not plausibly allege that the plaintiffs possessed a legally protected privacy interest. The court granted the motion to dismiss this claim.

Injunctive relief

Noom argued that the plaintiffs did not allege an intent to use Noom’s platform in the future, which the court treated as a defect in their standing to seek an injunction. The plaintiffs abandoned Graham’s request for injunctive relief and argued that Moise’s intent could be inferred and that any defect could be cured through amendment. The court dismissed Graham’s claim for injunctive relief with prejudice and Moise’s claim for injunctive relief with leave to amend.

Personal jurisdiction over FullStory

The court held that the plaintiffs did not make the required initial showing of specific personal jurisdiction over FullStory. The complaint established only that FullStory was Noom’s software-service vendor. The court held that a vendor’s sale of a product to Noom, even if Noom had substantial business in California and the vendor knew that, did not establish specific personal jurisdiction over the vendor.

The plaintiffs based jurisdiction instead on their allegation that FullStory wiretapped Noom website users, including California residents. Because the court found that the plaintiffs did not plausibly plead wiretapping, they did not meet their initial burden to establish specific personal jurisdiction over FullStory.

Disposition

Judge Laurel Beeler granted the defendants’ motions to dismiss. The court dismissed the complaint with leave to amend within 21 days, except that Graham’s claim for injunctive relief was dismissed with prejudice. Any amended complaint had to include a comparison showing the changes from the current complaint.